In short

The JavaScript side is in package-lock.json or yarn.lock . A typical React Native app has hundreds of packages there.

Leave out what does not ship, such as test and build tools, and add the native side from ios/Podfile.lock and the Android Gradle build.

With Expo, generate the native folders first with npx expo prebuild .

Why it matters for React Native in particular

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) applies to software placed on the EU market as part of a commercial activity, which covers most apps published by companies. Annex I, Part II requires a software bill of materials (SBOM) in a commonly used, machine-readable format, covering at least the top-level dependencies.…