fix: update dependencies to resolve security vulnerabilities#195
fix: update dependencies to resolve security vulnerabilities#195Muneerali199 wants to merge 1 commit intoAOSSIE-Org:mainfrom
Conversation
📝 WalkthroughWalkthroughFrontend/package.json updated to remove deprecated Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Frontend/package.json`:
- Around line 22-23: The Expo SDK version bump in package.json (keys "expo" and
"expo-font") conflicts with pinned React Native (0.77.1), React (18.3.1) and
Node >=18; either revert "expo" to the SDK that matches RN 0.77.1 or perform a
coordinated platform upgrade to RN 0.83+, React 19.2 and Node >=20.19.4, update
app integration files (app.json, babel.config.js, metro.config.js,
AppDelegate.swift, Podfile, MainApplication.kt) and ensure newArchEnabled=true
is supported, and replace incompatible react-native-fs with expo-file-system (or
a validated New-Arch fork); after changes run npx expo-doctor@latest to validate
dependency compatibility before merging.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 1808270f-241b-4ca2-bec3-676587cd2941
⛔ Files ignored due to path filters (1)
Frontend/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (1)
Frontend/package.json
Frontend/package.json
Outdated
| "expo": "^55.0.5", | ||
| "expo-font": "^55.0.4", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python - <<'PY'
import json
from pathlib import Path
data = json.loads(Path("Frontend/package.json").read_text())
deps = data.get("dependencies", {})
dev = data.get("devDependencies", {})
print("dependencies:")
for key in ("expo", "expo-font", "react", "react-native", "react-native-fs"):
print(f" {key}: {deps.get(key)}")
print("devDependencies:")
print(f" `@babel/runtime`: {dev.get('@babel/runtime')}")
print("engines:")
print(f" node: {data.get('engines', {}).get('node')}")
PY
printf '\n== potential Expo integration files ==\n'
fd -HI '^(app\.json|app\.config\.(js|ts|mjs|cjs)|babel\.config\.(js|cjs|mjs)|metro\.config\.(js|cjs|mjs)|index\.(js|jsx|ts|tsx)|Podfile|AppDelegate\.(m|mm|swift)|MainApplication\.(java|kt)|build\.gradle|settings\.gradle|gradle\.properties)$' Frontend
printf '\n== Expo integration markers ==\n'
rg -nP "registerRootComponent|use_expo_modules!|expo/metro-config|babel-preset-expo|newArchEnabled|install-expo-modules" Frontend -g '!Frontend/node_modules/**' || echo "(no matches found)"Repository: AOSSIE-Org/BabyNest
Length of output: 1935
🌐 Web query:
Expo SDK 55 React Native React Node version compatibility requirements
💡 Result:
Expo SDK 55 compatibility (versions you should use):
- React Native: 0.83.x (Expo notes SDK 55 supports React Native 0.83.2) [2]
- React: 19.2 [1]
- Node.js (supported ranges): ^20.19.4, ^22.13.0, ^24.3.0, ^25.0.0 [1]
Sources:
[1] Expo SDK 55 changelog (tool version bumps + React/React Native targets) https://expo.dev/changelog/sdk-55
[2] Expo “How to upgrade to SDK 55” (RN 0.83.2 + React 19.2) https://expo.dev/blog/upgrading-to-sdk-55
🌐 Web query:
Expo SDK 55 react-native-fs compatibility known issues
💡 Result:
Expo SDK 55 ↔ react-native-fs compatibility (and known issues)
- Expo SDK 55 runs only on React Native’s New Architecture (Fabric/TurboModules/bridgeless) and it cannot be disabled. This matters because some older/native-bridge libraries break or are unsupported in this mode. [1][2]
react-native-fsis explicitly called out by Expo as “known to be incompatible” with the New Architecture (the mode SDK 55 requires). Expo’s guidance is to useexpo-file-systemor a fork ofreact-native-fsinstead. [1]- If you’re trying to use
react-native-fsin Expo Go: Expo Go is New-Architecture-only, and it also won’t include arbitrary native modules—soreact-native-fsgenerally won’t work there. Plan on using a development build (custom native runtime) while you migrate toexpo-file-systemor test a fork. [1][3] - Recommended way to identify breakage before/while upgrading: run
npx expo-doctor@latest, which checks dependency compatibility against React Native Directory data (including New Architecture flags). [1]
Practical takeaway
For SDK 55, treat react-native-fs as not supported unless you’re prepared to (a) swap to expo-file-system, or (b) adopt and validate a New-Architecture-compatible fork in a dev build / EAS Build pipeline. [1]
Sources: Expo New Architecture guide [1], Expo “How to upgrade to SDK 55” [2], Expo SDK 55 changelog [3].
Expo SDK 55 version mismatch must be resolved before merging.
This upgrades Expo to SDK 55, which requires React Native 0.83.x, React 19.2, and Node ≥20.19.4. The manifest still pins React Native 0.77.1, React 18.3.1, and Node ≥18—all below SDK 55's requirements. Expo integration files (app.json, babel.config.js, metro.config.js, AppDelegate.swift, Podfile, MainApplication.kt) and New Architecture support (newArchEnabled=true) are already in place, so the integration is not incomplete; the blocker is the version incompatibility.
Additionally, react-native-fs is explicitly incompatible with React Native's New Architecture (which SDK 55 requires and cannot disable). Replace it with expo-file-system or a fork validated for New Architecture before upgrading.
Action: Either downgrade Expo to match React Native 0.77.1's baseline, or coordinate this with a full stack upgrade (React Native 0.83+, React 19.2, Node 20.19+). Run npx expo-doctor@latest to validate all dependencies.
Also applies to: 49-49
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Frontend/package.json` around lines 22 - 23, The Expo SDK version bump in
package.json (keys "expo" and "expo-font") conflicts with pinned React Native
(0.77.1), React (18.3.1) and Node >=18; either revert "expo" to the SDK that
matches RN 0.77.1 or perform a coordinated platform upgrade to RN 0.83+, React
19.2 and Node >=20.19.4, update app integration files (app.json,
babel.config.js, metro.config.js, AppDelegate.swift, Podfile,
MainApplication.kt) and ensure newArchEnabled=true is supported, and replace
incompatible react-native-fs with expo-file-system (or a validated New-Arch
fork); after changes run npx expo-doctor@latest to validate dependency
compatibility before merging.
- Updated @babel/runtime to ^7.26.10 (security fix) - Removed deprecated react-navigation and react-navigation-bottom-tabs - Reverted expo to compatible version (expo-font ^13.0.3) - Fixed 48 vulnerabilities (reduced from 50 to 2) - Remaining 2 vulnerabilities in markdown-it (no fix available)
Muneerali199
force-pushed
the
fix/dependency-security-updates
branch
from
046c551 to
8c102c8
Compare
2 participants
Summary
Security
Testing
fix ## 🔒 Security Vulnerability Fix #196
before
after
[
]
Summary by CodeRabbit