Repository navigation
Release 1.9.3 - #86
Merged
Merged
Conversation
Close 13 of 14 open Dependabot alerts via npm overrides on transitive dev
dependencies. All affected packages are dev-only tooling; the published
package's runtime dependencies are unchanged.
shell-quote 1.8.4 -> 1.10.0 (#171, #166)
js-yaml 3.x 3.14.2 -> 3.15.0 (#169, #164, #161, #160)
js-yaml 4.x 4.2.0 -> 4.3.0 (#170, #165)
brace-expansion 1.1.15 -> 1.1.16 (#168, #162)
brace-expansion 2.x -> 2.1.3 (#163)
fast-xml-parser 4.5.6 -> 5.10.1 (#138, #137)
Use overrides rather than `npm audit fix`, which wanted to pull
@react-native-community/cli v18 -> v20 (tied to RN 0.81+).
fast-xml-parser required a major bump: GHSA-gh4j is only patched in 5.7.0
with no 4.x backport.
Alert #167 (brace-expansion GHSA-mh99, <= 5.0.7) is left open. It is
patched only in 5.0.8, whose CommonJS entry exports an object rather than
a callable, breaking minimatch@3's `require('brace-expansion')(...)` on
any pattern containing braces. minimatch@3 is pervasive in the RN 0.79
toolchain, so this needs an RN major upgrade.
Also repair two pre-existing breakages in the example app:
- Tests failed at import with "__fbBatchedBridgeConfig is not set" because
the react-native jest preset does not stand up a native bridge and the
SDK resolves its native module at import time. Add jest.setup.js
populating global.nativeModuleProxy, which RN checks before the
invariant.
- `npm run lint` had been inert since the ESLint 9 bump.
@react-native/eslint-config@0.79.7 bundles eslint-plugin-ft-flow, which
declares eslint ^8.1.0 and calls the removed context.getAllComments().
Pin eslint to ^8.57.0 and resolve plugins relative to the config package,
whose plugins install nested rather than hoisted.
Fix the two lint errors this surfaced: drop an unused React import and
rename the unused isModuleLoaded binding (its setter is still used).
Verified: root tsc + react-native config pass; example tsc, lint (0 errors),
jest (1/1), and an Android production bundle all pass.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Module resolution preferred NativeModules.RNRefiner whenever it existed, so a successfully resolved TurboModule was discarded and the legacy bridge was used instead. On Expo SDK 57 the log sequence was: TurboModule loaded successfully via TurboModuleRegistry Using legacy module from NativeModules The TurboModule registered correctly and was then thrown away. Since isNewArchitecture was pinned to false on that path, the wrapper also chose the legacy null-handling for identifyUser/setUser/addToResponse, which passes null where the TurboModule spec declares the argument non-nullable. Reverse the preference: TurboModule first, NativeModules as fallback. React Native still serves legacy modules through its bridge interop layer, so setups without a registered TurboModule (and the legacy architecture) keep working unchanged. Also fixed while reordering: - The resolution block assigned NativeModules.RNRefiner to the TurboModule variable and set turboModuleAvailable = true. Harmless when the legacy branch was checked first; after the reordering it would have marked a legacy module as New Architecture and applied the wrong null-handling. The two are now resolved independently and never conflated. - Use TurboModuleRegistry.get() rather than getEnforcing() in a try/catch, so a missing module is a null return instead of exception control flow. - Drop the trailing fallback branch, which retried the same get() call that had already run. - Remove the console.log calls from this path; they ran on every app start in production builds. Verified on an Expo SDK 57 app (RN 0.86): - Android: RNRefiner.isNewArchitecture() now returns true (was false); SDK initializes and renders a survey, no errors in logcat - iOS: no TurboModule is registered (RCT_EXTERN_MODULE without RCTTurboModule conformance), so it takes the NativeModules fallback and behaves exactly as before; SDK initializes and renders a survey Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
chore: update android native SDK to 1.7.6
chore: update ios native SDK to 1.7.2
Close 23 of 25 open Dependabot alerts by bumping transitive dev/build tooling deps to their patched versions via `npm audit fix` (no --force), in both the root and example lockfiles: browserslist 4.28.1 -> 4.28.8 (#191, #189, #188) js-yaml 3.x 3.15.0 -> 3.15.2 (#185, #180, #170, #169, #165, #164, #161, #160) js-yaml 4.x 4.3.0 -> 4.3.2 (#184, #179) brace-expansion 1.1.16 -> 1.1.18 (#177, #176, #168, #163, #162) shell-quote 1.8.4 -> 1.10.0 (#171, #166) fast-xml-parser 4.x -> 5.10.1 (#138, #137) @humanfs/node dropped entirely (#190, transitive dep of a since-removed package) No package.json changes — npm resolved everything within existing semver ranges, so no direct-dependency version bumps or `overrides` entries were needed this time (unlike 344c154). Left open: image-size (#181, #182). Both GHSA-w3rx and GHSA-5p2g have no non-breaking fix — `npm audit fix --force` wants to pull react-native 0.79.7 -> 0.86.3 via the metro toolchain. That's a major-version call for the example app, out of scope for a dependency-patch commit. qs (GHSA-x5fp, transitive via body-parser) is not included: Dependabot already auto-dismissed it, so it isn't one of the 25 open alerts. Verified: root tsc --noEmit (matches CI), example lint (0 errors, 4 pre-existing warnings) and jest (1/1) all pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The "files" allowlist included "android/" wholesale. npm's allowlist takes precedence over .gitignore for explicitly included directories, so every local build artifact was published even though .gitignore already covers them and git does not track them. The 1.9.2 tarball shipped 245 files (912 kB), of which 214 were junk: - android/build/ (166 files): compiled .class, .dex, Gradle transform caches - android/.gradle/ (31) and android/.idea/ (17): local tool state - android/local.properties: contains an absolute SDK path from the publisher's machine (sdk.dir=/Users/<name>/Library/Android/sdk), in a file whose own header says it must not be checked in - ios/**/xcuserdata/: Xcode UI state including the publisher's username Narrow "files" to the sources consumers actually build against, and add explicit negations so this cannot regress if the directory patterns are widened again. Also drop react-native.config.js from the list; no such file exists in the repo. Result: 245 files / 912 kB -> 24 files / 20.9 kB. The gradle wrapper and settings.gradle were also dropped: those build the library standalone and are unused by consumers, which the verification below confirms. Verified by installing the repacked tarball into a fresh Expo SDK 57 app (RN 0.86) and running expo prebuild: - Android: BUILD SUCCESSFUL; RNRefinerPackage autolinked into PackageList; NativeRNRefinerSpec, RNRefinerTurboModule, RNRefinerPackage all present in the APK dex (codegen regenerates the spec from src/, so removing the prebuilt android/build/ output costs nothing) - iOS: BUILD SUCCEEDED; pod resolved and linked from Podfile.lock Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
fix: stop publishing build output and local machine paths to npm
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merging this PR will automatically create tag(s):
1.9.3and trigger the release CI.