Skip to content

Conversation

@pull
Copy link

@pull pull bot commented Jan 14, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

kitten and others added 9 commits January 14, 2026 16:46
…42156)

# Why

These endpoints shouldn't be accessible from any remote, but are
intended to only be used from `localhost`. This affects the CDP
websocket and the devtools websocket. Any remote connection should be
disabled and the connection should be dropped. Similar, the request
middleware should reject any remote requests.

# How

- Add `isLocalSocket` and `isMatchingOrigin` checks
- Reject remote sockets on CDP websocket connection
- Reject remote sockets on devtools websocket connection
- Reject mismatching origin on CDP websocket connection
- Reject mismatching origin on devtools websocket connection
- Only activate devtools websocket for non-exporting modes

# Test Plan

- Unit tests added for `isLocalSocket`
- Try to access debugger endpoints from a different machine on the same
network to observe request middleware not activating
- Try to connect from a different machine on the same network to observe
active `close` of socket
- Try to alter `Origin` to oberve active `close` of socket
- Test that an app on the local network can still connect to CDP

**Manual Checks:**
- [x] Tested manually on macOS
- [ ] Tested manually on Linux
- [x] Tested manually on Windows

# Checklist

<!--
Please check the appropriate items below if they apply to your diff.
-->

- [x] I added a `changelog.md` entry and rebuilt the package sources
according to [this short
guide](https://github.com/expo/expo/blob/main/CONTRIBUTING.md#-before-submitting)
- [ ] This diff will work correctly for `npx expo prebuild` & EAS Build
(eg: updated a module plugin).
- [ ] Conforms with the [Documentation Writing Style
Guide](https://github.com/expo/expo/blob/main/guides/Expo%20Documentation%20Writing%20Style%20Guide.md)
…41883)

# Why

<img width="294" height="493" alt="image"
src="https://github.com/user-attachments/assets/88a7dc65-40be-437c-99c9-4c68ef98171e"
/>


Follow up to same feature for `Toolbar.Button`

# How

<!--
How did you build this feature or fix this bug and why?
-->

# Test Plan

1. Manual testing

# Checklist

<!--
Please check the appropriate items below if they apply to your diff.
-->

- [ ] I added a `changelog.md` entry and rebuilt the package sources
according to [this short
guide](https://github.com/expo/expo/blob/main/CONTRIBUTING.md#-before-submitting)
- [ ] This diff will work correctly for `npx expo prebuild` & EAS Build
(eg: updated a module plugin).
- [ ] Conforms with the [Documentation Writing Style
Guide](https://github.com/expo/expo/blob/main/guides/Expo%20Documentation%20Writing%20Style%20Guide.md)
…activity recreation when screen is folded (#42150)

# Why

Fixes: #41808

On foldable Android devices like Galaxy Fold 6, folding or unfolding the
screen triggers an activity recreation because smallestScreenSize
configuration change is not handled. This causes the "linking configured
in multiple places" error in expo-router apps and state loss in other
apps.

|  | Before | After |
|--|--|--|
| expo-router | <video
src="https://github.com/user-attachments/assets/d01ccc95-d507-4a47-a782-289828ef196c"
/> | <video
src="https://github.com/user-attachments/assets/7e351a3e-14a1-4b04-b4a0-e888d198c89b"
/> |
| bare-expo | <video
src="https://github.com/user-attachments/assets/e3da100c-60e9-4925-a0f5-e9521bb81d76"
/> | <video
src="https://github.com/user-attachments/assets/6b5d8ef9-1e07-49bb-ba56-2237591096b9"
/> |

# How

Added smallestScreenSize to android:configChanges in the Android
manifest template and bare-expo app

# Test Plan

Test rotation and folding/unfolding of router-e2e and bare-expo. Make
sure to prebuild the router-e2e first.

# Checklist

<!--
Please check the appropriate items below if they apply to your diff.
-->

- [ ] I added a `changelog.md` entry and rebuilt the package sources
according to [this short
guide](https://github.com/expo/expo/blob/main/CONTRIBUTING.md#-before-submitting)
- [ ] This diff will work correctly for `npx expo prebuild` & EAS Build
(eg: updated a module plugin).
- [ ] Conforms with the [Documentation Writing Style
Guide](https://github.com/expo/expo/blob/main/guides/Expo%20Documentation%20Writing%20Style%20Guide.md)
# Why

The `browserslist` warnings are displayed multiple times when running
`expo start`:

```
| Browserslist: browsers data (caniuse-lite) is 8 months old. Please run:
|   npx update-browserslist-db@latest
|   Why you should do it regularly: https://github.com/browserslist/update-db#readme
| Browserslist: browsers data (caniuse-lite) is 8 months old. Please run:
|   npx update-browserslist-db@latest
|   Why you should do it regularly: https://github.com/browserslist/update-db#readme
| Browserslist: browsers data (caniuse-lite) is 8 months old. Please run:
|   npx update-browserslist-db@latest
|   Why you should do it regularly: https://github.com/browserslist/update-db#readme
| Browserslist: browsers data (caniuse-lite) is 8 months old. Please run:
|   npx update-browserslist-db@latest
|   Why you should do it regularly: https://github.com/browserslist/update-db#readme
| Browserslist: browsers data (caniuse-lite) is 8 months old. Please run:
|   npx update-browserslist-db@latest
|   Why you should do it regularly: https://github.com/browserslist/update-db#readme
```

# How

Suppress `browserslist` warnings with the `BROWSERSLIST_IGNORE_OLD_DATA`
environment variable.

# Test Plan

- CI
- Manual testing

# Checklist

- [x] I added a `changelog.md` entry and rebuilt the package sources
according to [this short
guide](https://github.com/expo/expo/blob/main/CONTRIBUTING.md#-before-submitting)
- [x] This diff will work correctly for `npx expo prebuild` & EAS Build
(eg: updated a module plugin).
- [ ] Conforms with the [Documentation Writing Style
Guide](https://github.com/expo/expo/blob/main/guides/Expo%20Documentation%20Writing%20Style%20Guide.md)
@pull pull bot locked and limited conversation to collaborators Jan 14, 2026
@pull pull bot added the ⤵️ pull label Jan 14, 2026
@pull pull bot merged commit 9ecce94 into code:main Jan 14, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants