Skip to content

Update react-native to 0.7x - #21122

Closed
jchen351 wants to merge 61 commits into
mainfrom
Cjian/cg
Closed

Update react-native to 0.7x#21122
jchen351 wants to merge 61 commits into
mainfrom
Cjian/cg

Conversation

@jchen351

@jchen351 jchen351 commented Jun 20, 2024

Copy link
Copy Markdown
Contributor

Description

Updates react-native to 0.74 and run npm audit fix

Motivation and Context

Trying to fix CGs that associated with npm.

Dependent

@snnn
snnn requested review from fs-eire and skottmckay June 20, 2024 21:34
@snnn

snnn commented Jun 20, 2024

Copy link
Copy Markdown
Contributor

This change is surprisingly huge.

@jchen351

jchen351 commented Jun 20, 2024

Copy link
Copy Markdown
Contributor Author

This change is surprisingly huge.

Because those 2 yarn.lock files are generated by npm.

I think it might be better generate them during the CI runtime, instead of committing them to the git repo.

@jchen351
jchen351 requested a review from edgchen1 June 20, 2024 22:07
@snnn

snnn commented Jun 20, 2024

Copy link
Copy Markdown
Contributor

@skottmckay , do we need to keep the file there? Nobody can really review the 5 thousand lines of change. Therefore I would think it is a security risk, because we don't exactly know what are brought in there.

@jchen351

Copy link
Copy Markdown
Contributor Author

This PR requires #17361

@skottmckay

Copy link
Copy Markdown
Contributor

AFAIK the contents of the yarn.lock files don't affect the bits we ship so it may not matter too much. @fs-eire is that correct?

This would suggest it's better to checkin yarn.lock for things to be deterministic, but that's countered by our project being a library not an app. https://stackoverflow.com/questions/39990017/should-i-commit-the-yarn-lock-file-and-what-is-it-for

Maybe that equates to checking in yarn.lock for the e2e test app and not checking it in for the top-level project.

@fs-eire

fs-eire commented Jun 24, 2024

Copy link
Copy Markdown
Contributor

The file is already excluded in the library (NPM package).

Keeping it in the code source helps to make it consistency between all dev environment, which avoid strange errors on CI, for example.

@jchen351
jchen351 requested a review from a team July 17, 2024 20:13
@jchen351 jchen351 changed the title Update react-native to 0.74 and run npm audit fix Update react-native to 0.7x Sep 17, 2024
@jchen351 jchen351 closed this Mar 11, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants