I counted how many versions expo install starts recommending after one patch bump
What expo install recommends is tied to the patch version of expo itself. I measured the ledger diff against the npm registry, how far npm install drifts, and the one check worth adding to a generated project.
Nine Expo patches shipped in thirty days. Which one is your app actually running?
A tilde in package.json does not mean you are on the newest patch. The file that decides what actually gets installed is package-lock.json. Here is what npm did when I ran the checks myself.
Auditing the Dependencies Rork Generates: A Supply-Chain Hygiene Routine
Even a four-screen Rork app pulls in 900+ transitive dependencies. Before a vulnerability lands and you cannot tell which app is affected, build an audit habit with npm ls, npm audit, overrides, and depcheck — framed for running several apps at once.
Fixing Expo Dependency Errors in Rork Apps
A practical guide to resolving Expo dependency conflicts and errors in Rork-generated applications. Learn to fix version mismatches, installation failures, and compatibility issues.