Managed React libraries
NKLattice’s policy 5.0.0 keeps framework requirements in profiles and adds managedPackages for commonly used React libraries. These rules are conditional: an app does not have to install every package. If its manifest declares a catalog package, or its source imports one, that app must declare it directly and its allowed range and locked resolution must meet the floor. A workspace-root declaration alone does not satisfy an importing app.
| Use | Packages and reviewed minimums |
|---|---|
| Routing | react-router >=7.0.0, react-router-dom >=7.0.0 |
| Server state | @tanstack/react-query >=5.0.0 |
| Client state | zustand >=5.0.0, @reduxjs/toolkit >=2.0.0, react-redux >=9.0.0 |
| Forms and validation | react-hook-form >=7.0.0, zod >=4.0.0 |
| Styling | tailwindcss >=4.0.0, @tailwindcss/vite >=4.0.0 |
| HTTP | axios >=1.0.0 |
These floors are reviewed product choices, not Vietnamese legal requirements or recommendations to add a package. We selected the catalog after checking public npm metadata and the maintainers’ docs on 18 October 2026. See React Router, TanStack Query, Zustand, Redux Toolkit, Zod, React Hook Form and Tailwind CSS. The policy does not imply that every future major version is compatible with your app; use tests and a reviewed upgrade PR.
What the gate checks
Section titled “What the gate checks”For each managed app, NKLattice reads dependencies, devDependencies and optionalDependencies, then scans supported JS/TS source imports. It checks a catalog package when either surface uses it. The app’s declared range must be entirely inside the approved >= range. The npm or pnpm importer must repeat the same specifier, and the resolved version must satisfy both ranges. A source import whose package is only declared at workspace root fails with required manifest declaration missing.
For example, zod: "^4.0.0" and a matching lockfile at 4.0.1 pass the default >=4.0.0 floor. zod: "^3.25.0" fails even if a hoisted install happens to expose Zod 4. Static imports, re-exports, literal import() and literal require() are recognized. Nonliteral dynamic imports and files outside supported JS/TS source cannot establish package usage. The dependency security domain still checks known advisories separately.
The central team can edit managedPackages in the policy. Review each floor with application owners, update manifests and lockfiles, run the complete governance gate, then move consumer repositories to the reviewed core SHA. A policy update does not change pinned consumer repositories automatically.