chore: add expo-doctor to CI and align deps to Expo SDK 57 (SDK-744) - #183
Merged
Conversation
Dependabot PR #179 failed both platform builds because the grouped npm bump included react-native 0.86 → 0.87, which no released Expo SDK supports yet. Add guardrails so the same class of failure doesn't recur. - Add an expo-doctor step to the lint job so bad dep combos fail in ~1 min instead of at platform build. - Ignore react, @types/react, react-native, @react-native/*, @babel/core minor+major bumps in the root dependabot block; add @react-native-async-storage/async-storage and @babel/core to the /example ignores. These are Expo-compat-matrix packages and must move only with an Expo SDK bump. - Carve out an expo-sdk group in the /example block so future Expo majors/minors land in their own PR instead of the routine bundle. - Align root package.json and example/package.json to the SDK 57 pins (react 19.2.3, react-native 0.86.2, babel-preset 0.86.2, @babel/core ^7.29.0) so yarn resolves to a single hoisted copy. - Set nmHoistingLimits: none so react/react-native hoist to root and expo-doctor no longer sees per-workspace duplicates. - Remove deprecated splash field from example/app.json (SDK 57 requires expo-splash-screen plugin config instead). - Add expo.install.exclude for typescript (we hold at 5.x) and expo.doctor.reactNativeDirectoryCheck.exclude for our own library. - Add AGENTS.MD to .gitignore alongside CLAUDE.md.
![semgrep-code-atomicfi[bot]](https://avatars.githubusercontent.com/u/52060187?s=60&v=4){kind=small}
|
Semgrep found 1 This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a ⚪️ This finding does not block your pull request. |
The prior ignore rule said "typescript 6 deprecates baseUrl and other config we use" — verified against this repo's tsconfig files, that's not accurate. Neither root nor example uses baseUrl. The real TS 6 change was tighter @types auto-inclusion under moduleResolution: bundler; jest globals and Node builtins are no longer auto-picked-up. Fixed by installing @types/node and setting an explicit types field in root tsconfig. Drop the typescript ignore from both dependabot blocks and remove typescript from expo.install.exclude so expo-doctor validates it against Expo SDK 57's ~6.0.3 pin.
Semgrep flagged that no cooldown was set. A 7-day window lets malicious or unstable newly published versions be caught upstream before we propose an update to them.
GHSA-5p4m-2wfm-xmqj (quadratic complexity on !!omap resolution) covers js-yaml 4.x below 4.3.1. Semgrep flagged the transitive 4.3.0 pulled in by @eslint/eslintrc, @expo/xcpretty, and cosmiconfig; pin all three to ^4.3.1 via yarn resolutions. @istanbuljs/load-nyc-config stays on 3.14.1 which isn't in the advisory range.
brax10ward
marked this pull request as ready for review
August 25, 2026 20:18
eriksargent
approved these changes
Aug 25, 2026
14 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linear Link
SDK-744
Type of change
Why
Dependabot PR #179 failed CI because grouped bumps included
react-native 0.87which no released Expo SDK supports. Add guardrails so bad dep combos fail at lint (~1 min) instead of at platform build (~13 min), and hold RN / React / Expo-managed packages to Expo SDK 57's compat matrix.Changes
expo-doctorstep in thelintjob (gates both platform builds).@react-native/*/@babel/core/async-storageminor+major bumps; carve out anexpo-sdkgroup for coordinated SDK upgrades; add a 7-day cooldown.react 19.2.3,react-native 0.86.2,@babel/core ^7.29.0); upgrade TypeScript 5 → 6 (added@types/nodeand explicittypes:in tsconfig — the old "TS 6 deprecates baseUrl" note was stale); bump transitivejs-yamlto^4.3.1viaresolutions(GHSA-5p4m-2wfm-xmqj).nmHoistingLimits: workspaces→noneso RN / React hoist to a single copy on disk (fixesexpo-doctor's duplicate-dep check).splashfield fromapp.json(SDK 57 wants theexpo-splash-screenplugin).Verification
yarn tscsilent ·yarn lintunchanged (0 errors) ·yarn test25/25 ·npx expo-doctor21/21 pass.Checklist: