Skip to content

Comments

[Snyk] Fix for 1 vulnerabilities#112

Open
snyk-io[bot] wants to merge 1 commit intomainfrom
snyk-fix-b51d21ae89c29f4282950f463808a7f4
Open

[Snyk] Fix for 1 vulnerabilities#112
snyk-io[bot] wants to merge 1 commit intomainfrom
snyk-fix-b51d21ae89c29f4282950f463808a7f4

Conversation

@snyk-io
Copy link

@snyk-io snyk-io bot commented Feb 20, 2026

snyk-top-banner

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

  • ClassicImplementation/package.json
  • ClassicImplementation/yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-15309438
  170  

Breaking Change Risk

Merge Risk: High

Notice: This assessment is enhanced by AI.


Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

…lock to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-15309438
@snyk-io snyk-io bot requested a review from a team as a code owner February 20, 2026 05:54
@snyk-io
Copy link
Author

snyk-io bot commented Feb 20, 2026

Merge Risk: High

This upgrade contains major versions for both react-native and its CLI, introducing significant breaking changes and a critical version mismatch between the two packages.

1. react-native 0.75.40.84.0 (HIGH RISK)

This is a substantial upgrade across nine minor versions, introducing major architectural changes, new requirements, and deprecations. The risk is high due to the sheer volume of changes and the effort required to migrate.

Key Breaking Changes:

  • Node.js Requirement: React Native 0.84.0 requires a minimum Node.js version of 22.
  • Legacy Architecture Removed: Starting in 0.84.0, Legacy Architecture code is no longer included in iOS builds by default. Apps not already migrated to the New Architecture will be significantly impacted.
  • API and Module Changes: Numerous APIs have been changed or removed between versions 0.75 and 0.84. For example, the JSIModule API was removed in 0.75, and Android's PopupMenu was extracted to a separate package.
  • Precompiled iOS Binaries: Version 0.84.0 enables precompiled binaries for iOS by default, which changes the build process.

2. @react-native-community/cli 10.2.713.5.2 (HIGH RISK due to incompatibility)

While this CLI upgrade has its own breaking changes, the primary issue is its incompatibility with react-native@0.84.0.

  • Version Incompatibility: According to the official compatibility matrix, @react-native-community/cli@13.x is intended for use with react-native@~0.74.x. Using it with react-native@0.84.0 is unsupported and will likely lead to build failures and runtime errors.
  • CLI Breaking Changes: Version 12.x raised the minimum Node.js version to 18 and replaced command-line flags like --variant and --configuration with --mode.

Recommendation:

  1. Correct CLI Version: Before proceeding, update @react-native-community/cli to a version compatible with react-native@0.84.0 (likely ^20.0.0 or newer).
  2. Use Upgrade Helper: This upgrade should not be attempted manually. Use the official **

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

@snyk-io snyk-io bot requested review from LiuPierre and cedancp-cs February 20, 2026 05:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

0 participants