[Snyk] Security upgrade react-native from 0.40.0 to 0.69.12#39
[Snyk] Security upgrade react-native from 0.40.0 to 0.69.12#39MHxGH-ServiceAccount wants to merge 1 commit into
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-AJV-15274295
|
Upgrading from Key Breaking Changes & Architectural Shifts:
Recommendation:
This upgrade should be treated as a full project rewrite or a major migration effort, not a routine dependency update. Source: React Native Upgrade Helper, React Native 0.69 Release Notes
|
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| "dependencies": { | ||
| "react": "^15.1.0", | ||
| "react-native": "^0.40.0", | ||
| "react-native": "^0.69.12", |
There was a problem hiding this comment.
Start script points to removed CLI path
High Severity
After upgrading react-native to ^0.69.12, the start script still executes node_modules/react-native/local-cli/cli.js. That legacy local-cli path is from older React Native layouts, so npm/yarn start can fail immediately because the entrypoint no longer exists in modern versions.
Additional Locations (1)
2 participants
Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.
Snyk changed the following file(s):
examples/TouchIDExample/package.jsonNote for zero-installs users
If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the
.yarn/cache/directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to runyarnto update the contents of the./yarn/cachedirectory.If you are not using zero-install you can ignore this as your flow should likely be unchanged.
Vulnerabilities that will be fixed with an upgrade:
SNYK-JS-AJV-15274295
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Regular Expression Denial of Service (ReDoS)
Note
Medium Risk
Although limited to an example app, upgrading React Native across many major/minor versions can introduce breaking changes and requires verifying the example still builds and runs.
Overview
Updates the
examples/TouchIDExampledependency onreact-nativefrom^0.40.0to^0.69.12to address a reported vulnerability in the dependency tree.Written by Cursor Bugbot for commit 2926a66. This will update automatically on new commits. Configure here.