Skip to content

[Snyk] Fix for 1 vulnerabilities #720

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
revan-zhang wants to merge 1 commit into
base: onekey
Choose a base branch
from
Open

[Snyk] Fix for 1 vulnerabilities #720

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions packages/connect-examples/expo-example/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,14 +47,14 @@
"burnt": "^0.13.0",
"compressorjs": "^1.1.1",
"elliptic": "^6.5.5",
"expo": "^50.0.20",
"expo": "^51.0.0",
Copy link
Copy Markdown

@cursor cursor bot Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Major Expo SDK bump breaks React Native compatibility

High Severity

Upgrading expo from ^50.0.20 to ^51.0.0 is a major SDK bump that requires react-native 0.74, but the project still pins react-native to 0.73.7. Additionally, several other Expo packages remain at SDK 50-compatible versions (expo-clipboard@~5.0.0, expo-document-picker@~11.10.1, expo-image-manipulator@~11.8.0, expo-image-picker@~14.7.1, expo-localization@~14.8.4, expo-status-bar@~1.11.1) and need corresponding upgrades for SDK 51 compatibility. This will likely cause build failures or runtime errors.

Additional Locations (1)
Fix in Cursor Fix in Web

Copy link
Copy Markdown

@devin-ai-integration devin-ai-integration bot Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Incomplete Expo SDK 50→51 upgrade leaves companion packages and React Native at incompatible SDK 50 versions

The expo core package was bumped from ^50.0.20 to ^51.0.0 (a major Expo SDK version change), but only expo-linking and expo-splash-screen were updated among the companion packages. Expo SDK major versions require all companion packages to be updated in lockstep. The following packages remain at their SDK 50-compatible versions and are incompatible with SDK 51:

  • react-native: 0.73.7 (SDK 51 requires RN 0.74)
  • expo-clipboard: ~5.0.0 (SDK 51 requires ~6.0.x)
  • expo-document-picker: ~11.10.1 (SDK 51 requires ~12.0.x)
  • expo-image-manipulator: ~11.8.0 (SDK 51 requires ~12.0.x)
  • expo-image-picker: ~14.7.1 (SDK 51 requires ~15.0.x)
  • expo-localization: ~14.8.4 (SDK 51 requires ~15.0.x)
  • expo-status-bar: ~1.11.1 (SDK 51 requires ~1.12.x)

This will cause native module version mismatches and build or runtime failures for the expo-example app.

Prompt for agents 
In packages/connect-examples/expo-example/package.json, the expo core was bumped to SDK 51 (^51.0.0) but the companion packages and react-native were not updated. Either:

1. Revert expo back to ^50.0.20 (and revert expo-linking and expo-splash-screen) if the goal is only to fix vulnerabilities without a full SDK upgrade, OR
2. Complete the SDK 51 upgrade by also bumping these packages to their SDK 51-compatible versions:
   - react-native: 0.73.7 → 0.74.x
   - expo-clipboard: ~5.0.0 → ~6.0.3
   - expo-document-picker: ~11.10.1 → ~12.0.1
   - expo-image-manipulator: ~11.8.0 → ~12.0.5
   - expo-image-picker: ~14.7.1 → ~15.0.7
   - expo-localization: ~14.8.4 → ~15.0.0
   - expo-status-bar: ~1.11.1 → ~1.12.1
   - react-native-reanimated: ~3.6.2 → ~3.10.0
   - react-native-safe-area-context: 4.8.2 → 4.10.1
   - react-native-screens: ~3.29.0 → ~3.31.1

Use 'npx expo install --fix' after updating expo to automatically resolve the correct companion package versions for the target SDK.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

"expo-clipboard": "~5.0.0",
"expo-document-picker": "~11.10.1",
"expo-image-manipulator": "~11.8.0",
"expo-image-picker": "~14.7.1",
"expo-linking": "~6.2.2",
"expo-linking": "~6.3.0",
"expo-localization": "~14.8.4",
"expo-splash-screen": "~0.26.5",
"expo-splash-screen": "~0.27.1",
"expo-status-bar": "~1.11.1",
"jotai": "^2.5.2",
"levelup": "^5.1.1",
Expand Down
Loading