vis-react has a dependency to vis in package.json as seen here: https://github.com/anishmprasad/vis-react/blob/master/package.json#L13
When vis has a new commit on the master, the hash value of that dependency changes for that package and cause the failure of the dependency check. The idea is keeping the dependency package always the same for a given particular version of vis package. It would solve the problem if vis could point an exact version or commit hash as it was done for lodash and uuid as an example.