chore(deps): update dependencies to latest pinned versions - #367
Draft
jimmydjabali wants to merge 1 commit into
Draft
chore(deps): update dependencies to latest pinned versions#367jimmydjabali wants to merge 1 commit into
jimmydjabali wants to merge 1 commit into
Conversation
Weekly dependency refresh. All updatable packages pinned to their latest exact version. Packages with breaking changes were only bumped when the new behavior could be kept identical and verified (npm install + patches + web production build + tsc). Breaking updates that require an unverifiable native rebuild or that break the build were held (see PR description for the full rationale). Applied: - Many safe minor/patch bumps (react 19.2.8, react-dom, styled-components 6.4.4, axios 1.19.0, react-hook-form 7.84.0, react-native-svg, react-native-video, @fortawesome/*, @LedgerHQ transports, etc.) - @sentry/webpack-plugin 4->5, react-native-dotenv 3->4, webpack-cli 6->7, @types/node 24->26, react-native-device-info 14->15, react-native-error-boundary 2->3, uuid 13->14, web-vitals 5->6, @fortawesome/react-native-fontawesome 0.3->1 - i18next 25->26 + react-i18next 15->17 (compatibilityJSON v3->v4; app has no plural keys so behavior is unchanged) - locale-currency 0.0.4->1.0.0 (now ESM named exports; updated Signup import) - ledger-bitcoin 0.2->0.3, bitbox-api 0.9->0.13 (used APIs unchanged) - Babel kept on 7.x, ESLint on 9.x, TypeScript on 5.x (bumped to latest within-major; next majors are incompatible with the RN 0.81 toolchain) - Renamed version-pinned patch-package patches to match bumped versions (react-native-web, lottie-react-native, @ledgerhq/react-native-hid) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwgeZj2qU34kBBN7J26vyf
✅ Deploy Preview for swissbitcoinpayapp ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for app-swiss-bitcoin-pay-ch ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Weekly dependency refresh. Every updatable dependency in
package.jsonis pinned to its latest exact version. Packages with a major / breaking change were only bumped when their changelog confirmed the new behavior could be kept identical and that was verifiable here (npm install+ patch-package + web production build +tsc). Everything that would require an unverifiable native rebuild, break the build, or change runtime behavior was held back and is listed below with the reason.Validation performed
npm installclean;patch-package --error-on-failapplies all 19 patcheswebpack --mode=production) compiles successfully (warnings only) — exerciseswebpack-cli7,@sentry/webpack-plugin5, Babel 7.29, and the patchedreact-native-web0.21.2tsc --noemit: 375 errors vs 383 pre-existing onmain(net −8, no new runtime-affecting errors). Note: the repo does not typecheck cleanly in CI regardless of this PR —npm run lintrunseslintfirst, which aborts on a hardcodedtsconfigRootDir: "/home/swiss-bitcoin-pay/sbp/app"ineslint.config.mjs(pre-existing, untouched here).testscript callsreact-scripts, which is not a dependency of this repo (pre-existing).Code changes made to preserve behavior
i18next26 +react-i18next17compatibilityJSON: "v3" → "v4"insrc/config/i18n/i18n-config.ts. The app has no plural keys /count:usage, so v3↔v4 suffix resolution is never exercised — behavior-neutral.locale-currency1.0.0src/screens/Signup/Signup.tsxfromimport LocaleCurrency from …/LocaleCurrency.getCurrency(...)toimport { getCurrency }/getCurrency(...).Updated (no code changes needed)
@sentry/webpack-plugin4→5,react-native-dotenv3→4,webpack-cli6→7,@types/node24→26,react-native-device-info14→15,react-native-error-boundary2→3,uuid13→14,web-vitals5→6,@fortawesome/react-native-fontawesome0.3→1,ledger-bitcoin0.2→0.3,bitbox-api0.9→0.13, plus many minor/patch bumps (react/react-dom19.2.8,styled-components6.4.4,axios1.19,react-hook-form7.84,react-native-svg,react-native-video,@fortawesome/*,@ledgerhqtransports, etc.). Babel, ESLint and TypeScript were bumped to the latest patch within their current major (7.29.7 / 9.39.5 / 5.9.3). The one caret (text-encoding-polyfill) was pinned.Three version-pinned
patch-packagepatch files were renamed to track their bumped packages (react-native-web→ 0.21.2,lottie-react-native→ 7.3.8,@ledgerhq/react-native-hid→ 6.39.5); the diffs still apply cleanly.⛔ Held back (NOT updated) — and why
These are intentionally left at their current versions. Each needs work that cannot be verified in this JS-only, native-build-less environment, or would change behavior.
Breaks the build / behavior
react-router-dom7.6.3 → 7.18.2 — v7.18 breaks the webpack production build (ConcatenatedModuleTypeError insidereact-router/distESM) and drops thefutureprop type used inRoot.tsx. Reverting to 7.6.3 restores a green build.@yudiel/react-qr-scanner2.1.0 → 2.6.0 — removedaudiofromIScannerComponentsand changed theonErrortype (both used inQRCamera.tsx). This drives the live camera/QR scanning of BTC addresses & invoices and can't be runtime-verified here.RA/Fabric-only or native setup that can't be verified (app runs the old/Paper architecture,
newArchEnabled=false)react-native-get-random-values1→2 — v2 is New-Architecture-only (TurboModule, no bridge fallback). Would breakcrypto.getRandomValues→uuid, BIP39 seed generation, wallet derivation.@react-native-community/slider4→5 — v5 is Fabric-only.react-native-webview13→14 — v14 is Fabric-only and we carry a custom native patch (androidWebviewId) that would need re-authoring.@react-native-async-storage/async-storage2→3 — v3 mandates an extra Android native setup step.react-native-screenguard1→2 — breakinginitSettings()API + native overlay rewrite on a screenshot-security control.react-native-bootsplash6→7 — Android edge-to-edge default + native splash asset regeneration.react-native-vision-camera4→5 — adds new peer deps (react-native-nitro-modules,react-native-nitro-image; Nitro rewrite).react-native-ble-plx3.4.0 → 3.5.1 — our version-pinned native patch (error-code rejection + iOScreateClient/scan null-handling for Ledger BLE) fails to apply on 3.5.1; kept at 3.4.0 so the patch stays valid.Correctness needs a physical device
@ledgerhq/hw-app-btc10→11 — JS API is unchanged, but v11 switches the Ledger wire protocol on thegetWalletXpub/signMessagepaths. Safe only after a one-off hardware smoke test (confirm identical zpub + signature), then it's a zero-code-change bump.Native/toolchain majors coupled to React Native 0.81
@sentry/react-native7→8 — needs Androidsentry-android-gradle-plugin5.7→6.0, an iOS pod reinstall, and regeneration of the 7.1.0-pinned patch.react-native0.81.4 and its version-locked satellites (@react-native/*,@react-native-community/cli*) are a coordinated native upgrade, out of scope for a JS dependency refresh.webpack-dev-server6 — incompatible with the RN 0.81 babel preset /@react-native/eslint-config+typescript-eslint8 / the TS toolchain plugins / the project'snode >=20engine floor (dev-server 6 needs>=22.15), respectively. Kept on their current major (latest patch).Generated by Claude Code