Skip to content

Feat: React Native Upgrade 0.81.5 #29156

Closed
adnxy wants to merge 74 commits into
mainfrom
rn-upgrade/0.81.5
Closed

Feat: React Native Upgrade 0.81.5 #29156
adnxy wants to merge 74 commits into
mainfrom
rn-upgrade/0.81.5

Conversation

@adnxy
Copy link
Copy Markdown
Contributor

@adnxy adnxy commented Apr 22, 2026

Description

Changelog

Dependencies & Runtime
React Native: 0.76.9 (patched Yarn resolution on main) → 0.81.5
React: 18.3.1 → 19.1.0
@types/react: ^18.2.6 → ^19.1.0
Expo: ~52.x → 54.0.33

React Native Toolchain
@react-native-community/cli (and platform packages): 15.x → 20.0.0
@react-native/metro-config: 0.76.9 → 0.81.5 (aligned with RN 0.81.5)

Testing
@testing-library/react-native: ^13.2.0 tests adjusted where behavior/matchers differ under React 19 / RN 0.81 (document any non-obvious test fixes in PR body).
Enzyme: Legacy enzyme / adapters still present where needed; migration toward RTL continues; @types/enzyme includes deprecation-oriented patch to steer new work to RTL.

CHANGELOG entry: Upgrade React Native to 0.81.5 and related dependencies.

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

Performance checks (if applicable)

  • I've tested on Android
    • Ideally on a mid-range device; emulator is acceptable
  • I've tested with a power user scenario
    • Use these power-user SRPs to import wallets with many accounts and tokens
  • I've instrumented key operations with Sentry traces for production performance metrics

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Szymon20000 and others added 30 commits March 6, 2026 11:10
- Convert defaultProps to default params on function components (React 19 ignores defaultProps)
- Add optional chaining for this.context?.colors in StyledButton class components
- Update eciesjs API usage in key-manager.ts (toBytes → compressed)
- Add pretty-format/react-is resolution to ^19.0.0 for snapshot serialization
- Fix testSetup.js: BottomSheet mock (goBack on close), react-native-modal mock (passthrough testID), NativeAnimatedHelper improvements
- Replace jest.resetAllMocks() with jest.clearAllMocks() where it destroyed global mock implementations
- Add await act(async () => { cleanup() }) for React 19 async cleanup flushing
- Update assertions for React 19 behavior (disabled buttons block events, fiber objects)
- Replace findByType(TouchableOpacity) with getByTestId() queries
- Update Reanimated mocks (withTiming, runOnJS, createAnimatedComponent)
- Fix missing mock data/props across ~100 test files
Updated 462 snapshot files to reflect React 19 element serialization
changes (react-is 19.x with pretty-format).
The global testSetup.js already mocks react-native-modal.
Remove redundant local mocks from ApprovalModal, FlowLoaderModal,
and TemplateConfirmationModal tests. Also fix resetAllMocks →
clearAllMocks in ApprovalModal.
React 19 ignores defaultProps on function components. Convert all
remaining instances to ES6 default parameters in destructured props.
Reference-type defaults (arrays, objects) are hoisted to module-level
constants to avoid re-creation on every render.

Only class components (EthereumAddress, FadeOutOverlay) retain
defaultProps, which React 19 still supports.
The global testSetup.js already calls setUpTests() which provides
the standard reanimated mock environment. Remove 5 test files that
had unnecessary local overrides.

6 files retain their local mocks because they need test-specific
behavior (custom shared value states, createAnimatedComponent
passthrough, or tightly coupled mock assertions).
Two separate blocks patched the same module. Consolidated into a
single Object.defineProperty getter approach which is more robust
than direct assignment.
…rrides

Add configureReanimatedLogger and ReanimatedLogLevel to the global
reanimated setup in testSetup.js. Simplify PerpsOrderView and
useColorPulseAnimation local mocks by removing the now-redundant
logger config.
Component doesn't use Redux — plain render() from RNTL suffices.
The other 10 files that switched to renderWithProvider genuinely
need it because child components access the Redux store.
…pshot()

Revert verbose toJSON destructuring pattern back to the simpler
expect(component).toMatchSnapshot() — both produce identical
snapshots since RNTL's render result has a toJSON() that
pretty-format calls automatically.

355 test files simplified, 26 files correctly kept toJSON() where
it was used for non-snapshot purposes (null checks, serialization).
Add tests/performance/ to testPathIgnorePatterns in jest.config.js.
These are Playwright tests that should only run via npx playwright test.
RNTL's fireEvent already wraps state updates in act internally,
making await act(async () => { fireEvent.press(...) }) redundant.

Removed 141 unnecessary wrappers across 18 test files. Kept act
wrappers where they're genuinely needed: cleanup(), timer advances,
hook result.current calls, and fireEvent triggering async operations
(ResetPassword, FooterButtonGroup, PerpsSlider).
@github-actions
Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@adnxy adnxy changed the title Rn upgrade/0.81.5 React Native Upgrade/0.81.5 Apr 22, 2026
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 22, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​metamask/​eth-snap-keyring@​20.0.0 ⏵ 18.0.299 +11009397 +250
Updatednpm/​@​react-native/​metro-config@​0.76.9 ⏵ 0.81.5100 +110073 +197100
Updatednpm/​react-native-mmkv@​3.2.0 ⏵ 4.3.1100 +11007493 +2100
Updatednpm/​expo-haptics@​14.0.1 ⏵ 15.0.874 +210084 +2100100
Updatednpm/​@​react-native-community/​cli@​15.0.1 ⏵ 20.0.098 +110075 +193100
Updatednpm/​expo-screen-orientation@​8.0.4 ⏵ 9.0.87610086 +1100 +1100
Updatednpm/​@​segment/​analytics-react-native@​2.20.3 ⏵ 2.22.098 -110076 +191100
Updatednpm/​expo-asset@​11.0.5 ⏵ 12.0.1277 +110080 +1100100
Updatednpm/​expo-font@​13.0.4 ⏵ 14.0.1177 +110084 +1100100
Updatednpm/​expo@​52.0.47 ⏵ 54.0.3377 -2210078 +1100 +1100
Updatednpm/​expo-image@​2.0.7 ⏵ 3.0.1178 +110091 +1100100
Updatednpm/​@​metamask/​browser-playground@​0.3.0 ⏵ 0.2.0781009992 -180
Updatednpm/​expo-file-system@​18.0.12 ⏵ 19.0.2178 +110085 +1100 +1100
Updatednpm/​react-native-safe-area-context@​5.4.0 ⏵ 5.6.210010078 +188100
Updatednpm/​@​metamask/​seedless-onboarding-controller@​9.0.0 ⏵ 6.1.099 +21007896100
Updatednpm/​react-test-renderer@​18.3.1 ⏵ 19.1.078 +410086 +398100
Updatednpm/​react-native-gesture-handler@​2.25.0 ⏵ 2.28.078 +11009499 +1100
Addednpm/​@​types/​react@​19.2.141001007988100
Updatednpm/​expo-dev-client@​5.0.20 ⏵ 6.0.2010010079100100
Updatednpm/​@​metamask/​eslint-config-typescript@​13.0.0 ⏵ 10.0.099 +110079 -384100
Updatednpm/​react-native-performance@​5.1.2 ⏵ 6.0.010010010082100
Updatednpm/​expo-updates@​0.27.4 ⏵ 29.0.169910083 +1100 +1100
Addednpm/​react-native-worklets@​0.7.4991008398100
Updatednpm/​expo-apple-authentication@​7.1.3 ⏵ 8.0.8100 +2510083100100
Updatednpm/​@​metamask/​react-native-payments@​2.0.0 ⏵ 2.0.294 -510010084 +3100
Addednpm/​eslint-plugin-import@​2.32.09710010084100
Addednpm/​react@​19.1.01001008497100
Updatednpm/​react-native-qrcode-svg@​5.1.2 ⏵ 6.3.2110010010084 +2100
Addednpm/​expo-build-properties@​1.0.1010010085100100
Updatednpm/​expo-sensors@​14.0.2 ⏵ 15.0.810010086 +2100 +1100
Updatednpm/​@​metamask/​react-native-acm@​1.2.0 ⏵ 1.0.289 -810086 -190 -2100
Updatednpm/​react-native-keyboard-controller@​1.20.6 ⏵ 1.18.5991008695 +1100
See 23 more rows in the dashboard

View full report

@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 22, 2026

Caution

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
System shell access: gem benchmark

Location: Package overview

From: ios/Gemfile.lockgem/benchmark@0.5.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore gem/benchmark@0.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @expo/metro-config in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/expo@54.0.33npm/@expo/metro-config@54.0.14

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@expo/metro-config@54.0.14. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: npm @expo/sudo-prompt in module child_process

Module: child_process

Location: Package overview

From: ?npm/expo@54.0.33npm/@expo/sudo-prompt@9.3.2

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@expo/sudo-prompt@9.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @sentry/react-native in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: package.jsonnpm/@sentry/react-native@7.2.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/react-native@7.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @shopify/flash-list in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: package.jsonnpm/@shopify/flash-list@2.0.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@shopify/flash-list@2.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm expo-build-properties in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: package.jsonnpm/expo-build-properties@1.0.10

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/expo-build-properties@1.0.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm glob in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/expo-auth-session@7.0.10npm/expo-dev-client@6.0.20npm/expo-asset@12.0.12npm/expo-updates@29.0.16npm/expo@54.0.33npm/glob@13.0.6

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/glob@13.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm lan-network in module dgram

Module: dgram

Location: Package overview

From: ?npm/expo@54.0.33npm/lan-network@0.1.7

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lan-network@0.1.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: npm lan-network in module child_process

Module: child_process

Location: Package overview

From: ?npm/expo@54.0.33npm/lan-network@0.1.7

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lan-network@0.1.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm react-devtools-core in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/react-native@0.81.5npm/react-devtools-core@6.1.5

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-devtools-core@6.1.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm react-native-mmkv in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: package.jsonnpm/react-native-mmkv@4.3.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-native-mmkv@4.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm react-native-video in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: package.jsonnpm/react-native-video@6.19.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-native-video@6.19.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @expo/devcert is now published by kudochien instead of philpl

New Author: kudochien

Previous Author: philpl

From: ?npm/expo@54.0.33npm/@expo/devcert@1.2.1

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@expo/devcert@1.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @expo/plist is now published by kudochien instead of expo-bot

New Author: kudochien

Previous Author: expo-bot

From: ?npm/expo-auth-session@7.0.10npm/expo-dev-client@6.0.20npm/expo-asset@12.0.12npm/expo-updates@29.0.16npm/expo@54.0.33npm/@expo/plist@0.4.8

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@expo/plist@0.4.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @expo/schema-utils is now published by kudochien instead of expo-bot

New Author: kudochien

Previous Author: expo-bot

From: ?npm/expo@54.0.33npm/@expo/schema-utils@0.1.8

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@expo/schema-utils@0.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm expo-apple-authentication is now published by kudochien instead of expo-bot

New Author: kudochien

Previous Author: expo-bot

From: package.jsonnpm/expo-apple-authentication@8.0.8

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/expo-apple-authentication@8.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm expo-crypto is now published by kudochien instead of expo-bot

New Author: kudochien

Previous Author: expo-bot

From: ?npm/expo-auth-session@7.0.10npm/expo-crypto@15.0.8

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/expo-crypto@15.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm expo-eas-client is now published by kudochien instead of expo-bot

New Author: kudochien

Previous Author: expo-bot

From: ?npm/expo-updates@29.0.16npm/expo-eas-client@1.0.8

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/expo-eas-client@1.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm expo-haptics is now published by kudochien instead of expo-bot

New Author: kudochien

Previous Author: expo-bot

From: package.jsonnpm/expo-haptics@15.0.8

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/expo-haptics@15.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm expo-keep-awake is now published by kudochien instead of expo-bot

New Author: kudochien

Previous Author: expo-bot

From: ?npm/expo@54.0.33npm/expo-keep-awake@15.0.8

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/expo-keep-awake@15.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm expo-screen-orientation is now published by kudochien instead of expo-bot

New Author: kudochien

Previous Author: expo-bot

From: package.jsonnpm/expo-screen-orientation@9.0.8

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/expo-screen-orientation@9.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm expo-sensors is now published by kudochien instead of expo-bot

New Author: kudochien

Previous Author: expo-bot

From: package.jsonnpm/expo-sensors@15.0.8

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/expo-sensors@15.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm expo-server is now published by kudochien instead of expo-bot

New Author: kudochien

Previous Author: expo-bot

From: ?npm/expo@54.0.33npm/expo-server@1.0.5

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/expo-server@1.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm expo-web-browser is now published by kudochien instead of expo-bot

New Author: kudochien

Previous Author: expo-bot

From: ?npm/expo-auth-session@7.0.10npm/expo-web-browser@15.0.10

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/expo-web-browser@15.0.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Deprecated by its maintainer: npm text-encoding with reason "no longer maintained"

Reason: no longer maintained

From: ?npm/react-native-qrcode-svg@6.3.21npm/text-encoding@0.7.0

ℹ Read more on: This package | This alert | What is a deprecated package?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/text-encoding@0.7.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Potential code anomaly (AI signal): npm @babel/helper-module-imports is 100.0% likely to have a medium risk anomaly

Notes: The analyzed code is a Babel AST helper (ImportBuilder) used to construct import statements and interop-wrapped imports. It contains no indicators of malicious behavior, data exfiltration, backdoors, or runtime abuses. It operates within a compiler/transpiler context to produce code, not to execute arbitrary user data. Therefore, the code itself does not present security risks or malware indicators under normal usage. This is benign library behavior intended for code transformation.

Confidence: 1.00

Severity: 0.60

From: ?npm/expo-asset@12.0.12npm/expo@54.0.33npm/react-native-worklets@0.7.4npm/@babel/preset-env@7.26.9npm/@react-native/babel-preset@0.76.9npm/@babel/core@7.27.1npm/metro-react-native-babel-preset@0.76.9npm/metro-react-native-babel-transformer@0.76.9npm/@react-native/metro-config@0.81.5npm/@babel/helper-module-imports@7.28.6

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/helper-module-imports@7.28.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 11 more rows in the dashboard

View full report

@adnxy adnxy added the team-mobile-platform Mobile Platform team label Apr 22, 2026
@adnxy adnxy changed the title React Native Upgrade/0.81.5 feat: React Native Upgrade 0.81.5 Apr 22, 2026
@github-actions
Copy link
Copy Markdown
Contributor

🔍 Smart E2E Test Selection

⏭️ Smart E2E selection skipped - draft PR

All E2E tests pre-selected.

View GitHub Actions results

@adnxy adnxy changed the title feat: React Native Upgrade 0.81.5 Feat: React Native Upgrade 0.81.5 (with enzyme) Apr 22, 2026
@adnxy adnxy changed the title Feat: React Native Upgrade 0.81.5 (with enzyme) Feat: React Native Upgrade 0.81.5 Apr 22, 2026
Comment thread package.json
"react-native-in-app-review": "^4.3.3",
"react-native-inappbrowser-reborn": "^3.7.0",
"react-native-jazzicon": "^0.1.2",
"react-native-keyboard-aware-scroll-view": "^0.9.5",
"react-native-keyboard-controller": "^1.20.3",
"react-native-keyboard-controller": "1.18.5",
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why this lib version was downgraded? 🤔

@adnxy adnxy closed this Apr 28, 2026
@github-actions github-actions Bot locked and limited conversation to collaborators Apr 28, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants