Publish the experimental React Native chart host

[tannerlinsley]

Summary

• make @tanstack/react-native-charts a public experimental package with compiled ESM, declarations, provenance, and react-native conditional exports
• keep the base host tooltip-free and publish the optional native tooltip from /tooltip
• add Expo 57 and bare React Native 0.86 fixtures using @tanstack/charts/universal
• add the package to the 12-package fixed release set with a minor changeset
• verify packed core and native tarballs from empty dependency trees through default bare and Expo Metro configurations

Install contract

After publication, a React Native application can install and import the adapter normally:

pnpm add @tanstack/charts @tanstack/react-native-charts d3-scale react-native-svg

import { defineChart, lineY } from '@tanstack/charts/universal'
import { Chart } from '@tanstack/react-native-charts'
import { tooltip } from '@tanstack/react-native-charts/tooltip'

The tested lanes are Expo 57 / React Native 0.86.2 with react-native-svg 15.15.4 and bare React Native 0.86.2 with react-native-svg 15.15.5. The published peer range is React ^19.2.3, React Native ^0.86.0, and react-native-svg >=15.15.4 <16.

The packed-consumer gate forces the adapter's transitive core dependency to the packed core tarball, uses each consumer's own TypeScript installation, and asserts that Metro resolves only installed dist modules. It bundles iOS and Android through both default Metro configurations. A separate base-entry bundle proves that importing the root does not retain the optional tooltip implementation.

Compatibility and support boundary

Existing browser imports and behavior are unchanged. The browser-first @tanstack/charts root remains the normal web entry; /universal is the cross-runtime barrel, and granular entries remain the bundle-sensitive path.

This PR makes package installation, imports, declarations, and Metro production bundles work. It does not claim supported device parity yet: simulator and physical-device visuals, gestures, VoiceOver/TalkBack, Hermes runtime profiling, memory, startup, and installed binary size remain unverified.

Bundle evidence

• React Native SVG host: 26.95 kB minified / 10.22 kB gzip
• host plus tooltip: 32.50 kB / 12.10 kB; tooltip delta 5.55 kB / 1.88 kB
• React Native line consumer: 49.18 kB / 19.03 kB
• full-chart Metro delta over blank: 434.28 KiB minified / 102.94 KiB gzip on iOS; 434.42 KiB / 102.99 KiB on Android
• /universal over the equivalent granular entry: 119.06 KiB minified / 28.91 KiB gzip / 102 modules on both platforms

Release prerequisite

@tanstack/react-native-charts is still absent from npm. Before the fixed changeset publishes 0.4.0, a maintainer must directly publish the checked 0.3.1 tarball with public access and 2FA, then configure TanStack/charts and release.yml as its trusted publisher. Normal aggregate releases can use OIDC after that one-time bootstrap.

Validation

• pnpm validate — all 17 CI targets; 126 test files and 667 tests
• pnpm react-native:poc:types
• packed declarations and empty-install bare/Expo Metro bundles for iOS and Android
• packed base-entry optional-tooltip boundary
• release workflow tests — 25 tests
• pnpm release:artifacts — 12 validated 0.3.1 artifacts

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: eb28041f-8f7a-49b1-9ccc-b300162affd4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	expo@​57.0.9
	@​react-native/​metro-config@​0.86.2
	@​react-native/​typescript-config@​0.86.2
	@​react-native-community/​cli@​20.1.0
	@​react-native/​babel-preset@​0.86.2
	react-native-svg@​15.15.5
	react-native-svg@​15.15.4
	react-native@​0.86.2
	@​react-native-community/​cli-platform-android@​20.1.0
	@​react-native-community/​cli-platform-ios@​20.1.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @react-native/debugger-frontend is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/react-native@0.86.2 → npm/expo@57.0.9 → npm/@react-native/debugger-frontend@0.86.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.86.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @react-native/debugger-frontend is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/react-native@0.86.2 → npm/expo@57.0.9 → npm/@react-native/debugger-frontend@0.86.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.86.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm fast-xml-parser is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@react-native-community/cli@20.1.0 → npm/@react-native-community/cli-platform-android@20.1.0 → npm/@react-native-community/cli-platform-ios@20.1.0 → npm/fast-xml-parser@4.5.7 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fast-xml-parser@4.5.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm node-forge is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/expo@57.0.9 → npm/node-forge@1.4.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/node-forge@1.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm fetch-nodeshim Location: Package overview From: pnpm-lock.yaml → npm/expo@57.0.9 → npm/fetch-nodeshim@0.4.10 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fetch-nodeshim@0.4.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Deprecated by its maintainer: npm uuid Reason: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). From: pnpm-lock.yaml → npm/expo@57.0.9 → npm/uuid@7.0.3 ℹ Read more on: This package | This alert | What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/uuid@7.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report