fix(MSK-147): upgrade React to 19.1.4 for critical security vulnerabilities#82
Merged
fix(MSK-147): upgrade React to 19.1.4 for critical security vulnerabilities#82
Conversation
- Update AGP from 7.2.1 to 8.11.0 (matches React Native 0.81) - Update compileSdk and targetSdk from 31 to 36 - Update Java compatibility from 1.8 to 17 (required by AGP 8.x) - Replace deprecated lintOptions with lint block - Keep minSdkVersion at 26 for backward compatibility This upgrade enables full Kotlin 2.1.0 language features support. AGP 7.2.1 was incompatible with Kotlin 2.0+, requiring minimum AGP 7.3.0. Tested: - All unit tests pass (88 passed, 1 skipped) - Library builds successfully with react-native-builder-bob 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Addresses critical security vulnerabilities: - CVE-2025-55182 (CVSS 10.0) - Remote Code Execution - CVE-2025-55184 (CVSS 7.5) - Denial of Service - CVE-2025-55183 (CVSS 5.3) - Source Code Exposure - CVE-2025-67779 - Additional vulnerability Changes: - Root: React ^19.1.1 → 19.1.4 (devDependency) - example-expo: React 19.1.0 → 19.1.4 (dependency) Testing: - All unit tests passing (88/88) - 94.17% code coverage maintained - Lint and typecheck clean - Library builds successfully Refs: MSK-147 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
cubic analysis
No issues found across 5 files
Linked issue analysis
Linked issue: MSK-147: React Native SDK: Upgrade React to 19.1.4+ for critical security vulnerabilities (CVE-2025-55182)
| Status | Acceptance criteria | Notes |
|---|---|---|
| ✅ | React upgraded to 19.1.4 or 19.2.3 in all package.json files | Root and example-expo package.json updated to 19.1.4 |
| ✅ | Upgrade React in root package.json (devDependency) | Root package.json react changed to "19.1.4" |
| ✅ | Upgrade React in example-expo/package.json | example-expo react and react-dom set to 19.1.4 |
| ❌ | All tests passing | No test run outputs or CI pass evidence in diffs |
| Android build successful | Android gradle/sdk settings updated but no build logs | |
| ❌ | iOS build successful | No iOS build verification or logs in diffs |
| Expo build successful (example-expo) | example-expo react bumped but no Expo build verification | |
| No compatibility issues with existing dependencies | Deps updated (react/react-dom) but compatibility tests not shown | |
| ✅ | Security scan confirms patched versions in use | yarn.lock shows react resolved to 19.1.4 |
| Test for Expo version mismatch errors (known issue) | example-expo updated but no explicit mismatch handling or tests | |
| ❌ | Test for react-native-svg compatibility (v15.12.2 issue) | No changes addressing react-native-svg compatibility found |
| ❌ | Test third-party library compatibility | No compatibility testing or verification evidence in diffs |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrades React from 19.1.1 to 19.1.4 to address critical security vulnerabilities.
Security Issues Addressed
Changes
Testing
Notes
References
🤖 Generated with Claude Code
Summary by cubic
Upgrades React to 19.1.4 to patch critical CVEs (CVE-2025-55182 and related) and aligns Android build tooling with Kotlin 2.1 and React Native 0.81. Meets the MSK-147 security requirements and keeps the Expo example in sync.
Dependencies
Migration
Written for commit caeb150. Summary will update on new commits.