Update dependencies - #29472
Merged
Merged
Conversation
Routine bump pass plus security fixes. Shared: - @react-navigation bottom-tabs/core/native/native-stack -> alpha.46/31/40/48 - @react-native/{babel-preset,eslint-config,metro-config} 0.86.1 -> 0.86.2 - react-native-worklets 0.11.3, @playwright/test 1.62.0, appium 3.6.0, eslint 10.8.0, storybook + @storybook/{react,react-vite} 10.5.5 Protocol: @types/node 26.1.2 Security: - postcss 8.5.15 -> 8.5.24 (lockfile re-resolve, GHSA-r28c-9q8g-f849) - brace-expansion -> 5.0.8 via resolutions (GHSA-mh99-v99m-4gvg); all installed copies were vulnerable, so the resolution is unscoped - react-native-kb: brace-expansion lockfile re-resolve Resolutions audit: dropped body-parser and shell-quote (both re-resolve to safe versions on their own). serialize-javascript and xcode/uuid tested for removal and restored -- without them they fall back to 6.0.2 and 7.0.3. Regenerated the native-stack patch for alpha.48; the fix is still not upstream. Skipped @babel/* 8.x (major, RN/Expo presets peer on ^7) and typescript 7.0.2 (the 6.x/7.x split is deliberate, typescript-eslint needs the classic API).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Routine dependency pass plus security fixes.
Bumped
shared
@react-navigation/{bottom-tabs,core,native,native-stack}→ alpha.46 / alpha.31 / alpha.40 / alpha.48@react-native/{babel-preset,eslint-config,metro-config}0.86.1 → 0.86.2 (stays on thereact-native0.86 line)react-native-worklets0.11.3@playwright/test1.62.0,appium3.6.0,eslint10.8.0,storybook+@storybook/{react,react-vite}10.5.5protocol
@types/node26.1.2Security
package.jsonchangeresolutionsentrybrace-expansionis the one worth a look: every installed copy (1.1.16, 2.1.2, 5.0.7) was vulnerable and the only patched release is 5.0.8, so the resolution is unscoped and force-bumps a major across all consumers — the minimatch chains under eslint, jest, mocha, appium and @electron/packager. v5 is ESM-first but still ships a CommonJS export, and lint, tsc and the full jest suite pass on it.yarn auditis clean in all three manifests (shared/,protocol/,rnmodules/react-native-kb/).Resolutions audit
Tested each existing entry by removing it, deleting its
yarn.lockblock, reinstalling and confirming the installed version actually changed:**/body-parserand**/shell-quote— both re-resolve to the same safe versions without the pin.**/serialize-javascript(falls back to 6.0.2 — mocha still pins^6.0.2) and**/xcode/uuid(falls back to 7.0.3 —xcodehas no release since 2021).Patches
@react-navigation/native-stackpatch regenerated for alpha.48 (applied cleanly, fix is still not upstream). All other patches target unchanged versions.Skipped
@babel/*7.29.7 → 8.x — major, and the RN/Expo babel presets peer on@babel/core ^7. Wants its own PR.typescript6.0.3 → 7.0.2 — the 6.x/7.x split is deliberate;typescript-eslintstill needs the classic JS compiler API.typescript-nativeis already on 7.0.2.eslint-plugin-react-compiler— the "newer" version npm reports is a hash-tagged rc.1, i.e. a downgrade.Validation
yarn lint✅yarn tsc✅yarn test:unit✅ 77 suites / 352 testsyarn auditclean in shared, protocol, react-native-kbios/build+ios/Pods(worklets is a native dep)