Skip to content

[Snyk] Security upgrade react-native from 0.83.0 to 0.84.0#119

Open
snyk-io[bot] wants to merge 1 commit into
mainfrom
snyk-fix-c8a78c649e07e405f35e650f749414e6
Open

[Snyk] Security upgrade react-native from 0.83.0 to 0.84.0#119
snyk-io[bot] wants to merge 1 commit into
mainfrom
snyk-fix-c8a78c649e07e405f35e650f749414e6

Conversation

@snyk-io
Copy link
Copy Markdown

@snyk-io snyk-io Bot commented Mar 28, 2026

snyk-top-banner

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

  • ClassicImplementation/package.json
  • ClassicImplementation/yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Infinite loop
SNYK-JS-BRACEEXPANSION-15789759
  99  

Breaking Change Risk

Merge Risk: Medium

Notice: This assessment is enhanced by AI.


Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

…lock to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-BRACEEXPANSION-15789759
@snyk-io
Copy link
Copy Markdown
Author

snyk-io Bot commented Mar 28, 2026

Merge Risk: Medium

This upgrade to React Native 0.84.0 introduces a mandatory environment change and other notable updates.

Key Changes:

  • Node.js Requirement: Support for Node.js versions below v22.11 has been dropped. You must upgrade your development environment to Node.js v22.11 or a later version before upgrading.
  • Hermes V1 by Default: The Hermes V1 JavaScript engine is now enabled by default, offering performance improvements. For most projects already using Hermes, this change is seamless and requires no action.
  • iOS Precompiled Binaries: iOS builds are now significantly faster as precompiled binaries are used by default.
  • Legacy Architecture Removal: The process of removing the legacy architecture continues, with more components removed on both iOS and Android. Apps already migrated to the New Architecture should not be affected.

Potential Breaking Changes:

  • A fix for a crash in the native RCTImage API on iOS has altered the observer API, which may affect native libraries that interact with it.
  • The legacy "Network" and "Perf" tabs have been removed from the in-app developer tools.

Recommendation:
Ensure your development environment is running Node.js v22.11+ before starting the upgrade. While most application code will not break, it is important to verify native dependencies and custom native modules for compatibility with the latest changes.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

@snyk-io snyk-io Bot requested a review from a team as a code owner March 28, 2026 16:23
@snyk-io snyk-io Bot requested review from LiuPierre and cedancp-cs March 28, 2026 16:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

0 participants