Dependencies

The React runtime is, by design, almost dependency-free at runtime. The dev-time toolchain is much larger.

Runtime dependencies (what ends up in the bundle)

Most published packages have no production dependencies at all. The exceptions:

Package	Dependencies
react	none.
react-dom	depends on react (peer) and scheduler.
react-reconciler	depends on scheduler.
react-server-dom-webpack	depends on react, react-dom, react-server, scheduler (all peer/internal).
react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-esm	similar.
react-native-renderer	depends on scheduler, plus the React Native runtime (peer).
react-test-renderer	depends on react-shallow-renderer.
react-refresh	none.
eslint-plugin-react-hooks	(the published version has none).
react-cache	depends on scheduler.
use-sync-external-store	none.
use-subscription	none.
react-art	depends on art.

The one external runtime dependency that shows up in multiple packages is art (used by react-art). Everything else is either internal to the monorepo or a peer dependency.

Why so few

React's package.json files are guarded carefully — the team treats every new production dependency as a long-term liability. The result is that a typical React app's node_modules/react/ is a single CJS file with no transitive dependencies, and the bundler can fully tree-shake it.

Dev dependencies (the toolchain)

The root package.json's devDependencies block is the dev-time toolchain. The largest entries by surface area:

• Babel — ~40 packages including @babel/core, @babel/preset-env, @babel/preset-react, @babel/preset-typescript, @babel/preset-flow, and a long list of transform/plugin packages. Used by both Rollup (for production build) and Jest (for transforming source under test).
• Rollup — rollup, plus @rollup/plugin-babel, @rollup/plugin-commonjs, @rollup/plugin-node-resolve, @rollup/plugin-replace, @rollup/plugin-typescript, rollup-plugin-dts, rollup-plugin-prettier, rollup-plugin-strip-banner.
• Jest — jest, jest-cli, jest-diff, jest-environment-jsdom, jest-silent-reporter, jest-snapshot-serializer-raw, pretty-format.
• ESLint — eslint@7, plus eslint-config-prettier, eslint-plugin-babel, eslint-plugin-es, eslint-plugin-eslint-plugin, eslint-plugin-ft-flow, eslint-plugin-jest, eslint-plugin-no-for-of-loops, eslint-plugin-no-function-declare-after-return, eslint-plugin-react@6, eslint-plugin-react-hooks-published, eslint-plugin-react-internal (link to scripts/eslint-rules), and @typescript-eslint/*.
• Flow — flow-bin, flow-remove-types, flow-typed.
• Prettier — prettier (v3) and prettier-2 (an alias for v2 — used in a small number of places).
• TypeScript — typescript@5.4. Used for the compiler workspace and a handful of typed scripts in this workspace.
• Hermes — hermes-eslint, hermes-parser, babel-plugin-syntax-hermes-parser. For Facebook's Hermes JS engine.
• google-closure-compiler — used by the Rollup build to produce smaller production bundles.
• fbjs-scripts — Facebook-shared build scripts.
• danger@11 — runs dangerfile.js in CI.
• signedsource — used to sign generated files so they can't be hand-edited without re-running the generator.

React-as-its-own-dependency

React tests against its own packages — for example, eslint-plugin-react-hooks-published is an alias for the latest published version of eslint-plugin-react-hooks, used so the runtime's own ESLint config dogfoods the published rules rather than the in-tree implementation. This catches "the published rule changed and now disagrees with the in-tree rule" mistakes early.

packageManager: "yarn@1.22.22" is pinned in the root package.json. Yarn 2/3/4 are not supported by the build scripts.

Compiler workspace dependencies

The compiler/ workspace has its own yarn.lock (471 KB; the runtime's is 823 KB). Notable dev dependencies there:

• @babel/types, @babel/parser, @babel/traverse, @babel/generator — the AST.
• pretty-format — the snap test runner uses it.
• tsup — bundles the compiler's TypeScript output.
• prettier-2 — the compiler workspace pins to Prettier 2 for historical reasons; the snap runner uses it for output formatting.

compiler/packages/react-mcp-server/ adds an MCP-server-specific dependency tree.

Lockfile size

The root yarn.lock is ~823 KB. The compiler's is ~471 KB. The runtime's lockfile dominates due to the long Babel + ESLint + Jest dependency tree. Total node_modules/ after yarn install is on the order of 2–3 GB.

Updating dependencies

Dependencies are bumped by Dependabot (/.github/dependabot.yml) for security advisories, and manually for everything else. Major upgrades to Babel, Rollup, or Jest tend to land as their own multi-PR project.

The compiler workspace's pinned Prettier 2 is the most-common-thing-people-want-to-upgrade — it stays pinned because the snap goldens depend on Prettier output formatting.