Skip to content

[Snyk] Fix for 1 vulnerabilities #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nick-gudumac wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 1 vulnerabilities #14

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,11 +17,11 @@
"@fortawesome/react-native-fontawesome": "^0.3.0",
"@react-native/eslint-config": "^0.75.0-main",
"@webview-bridge/react-native": "^1.4.0",
"expo": "~50.0.6",
"expo": "~52.0.0",
Copy link

@sentry sentry bot Nov 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: package.json and package-lock.json are out of sync, leading to incorrect dependency installations.
Severity: CRITICAL | Confidence: 0.99

🔍 Detailed Analysis

The package.json specifies expo: ~52.0.0 and react-native: 0.81.0, but package-lock.json still contains expo: ~50.0.6 and older react-native versions. This mismatch will cause npm ci to install incorrect, older dependency versions, leading to runtime crashes due to API incompatibilities, especially with React Native 0.81.0 expecting Node.js 18+ and different APIs.

💡 Suggested Fix

Manually update package-lock.json by running npm install or yarn install after modifying package.json.

🤖 Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: package.json#L20

Potential issue: The `package.json` specifies `expo: ~52.0.0` and `react-native:
0.81.0`, but `package-lock.json` still contains `expo: ~50.0.6` and older `react-native`
versions. This mismatch will cause `npm ci` to install incorrect, older dependency
versions, leading to runtime crashes due to API incompatibilities, especially with
`React Native 0.81.0` expecting Node.js 18+ and different APIs.

Did we get this right? 👍 / 👎 to inform future reviews.

Reference_id: 2680314

"expo-dev-client": "~3.3.11",
"expo-status-bar": "~1.11.1",
"react": "18.2.0",
"react-native": "0.73.6",
"react-native": "0.81.0",
Copy link

@sentry sentry bot Nov 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: react-native-keyboard-controller version ^1.11.5 is incompatible with React Native 0.81.0.
Severity: CRITICAL | Confidence: 0.98

🔍 Detailed Analysis

The react-native-keyboard-controller dependency is pinned at ^1.11.5, which is incompatible with the updated React Native 0.81.0. react-native-keyboard-controller requires version 1.18.0+ for compatibility with React Native 0.81.0+. This will cause build failures or runtime errors when the lock file is properly regenerated and the incompatible version is installed.

💡 Suggested Fix

Update the react-native-keyboard-controller constraint in package.json from ^1.11.5 to ^1.18.0.

🤖 Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: package.json#L24

Potential issue: The `react-native-keyboard-controller` dependency is pinned at
`^1.11.5`, which is incompatible with the updated `React Native 0.81.0`.
`react-native-keyboard-controller` requires version `1.18.0+` for compatibility with
`React Native 0.81.0+`. This will cause build failures or runtime errors when the lock
file is properly regenerated and the incompatible version is installed.

Did we get this right? 👍 / 👎 to inform future reviews.

Reference_id: 2680314

"react-native-keyboard-controller": "^1.11.5",
"react-native-reanimated": "^3.8.1",
"react-native-svg": "^15.1.0",
Expand Down