DIYgod
62 KiB
Mobile dependency review — 2026-09-22
Scope: direct mobile dependency changes reviewed against their actual published Git refs. Large monorepo comparisons were narrowed to the package and hand-written runtime/native/build code; generated bundles, lockfiles, example applications and unrelated experimental APIs are not represented as line-by-line product review. Each source below was read, not only downloaded. Formal changelogs are used where supplied; missing ones are explicitly identified and release-commit history substitutes are linked.
Dependency evidence and impact
| Dependency | Before → after | Upstream evidence | Changes and regression surface |
|---|---|---|---|
@expo/metro-runtime |
57.0.3 → 57.0.16 | History; Git diff | Reviewed runtime patch set and Expo monorepo changes: development loading/error integration and runtime alignment. Check Metro bundle/load and release startup. |
@react-native-community/image-editor |
4.3.0 → 4.3.1 | History; Git diff | AGP 9 conditionally applies Kotlin plugin; image editing implementation unchanged. Check native compilation and crop flow. |
babel-preset-expo |
57.0.2 → 57.0.12 | History; Git diff | Hermes v1 object-rest/destructuring transform ordering, decorators and lazy classes change. Check release Metro compilation and runtime execution. |
expo |
57.0.4 → 57.0.24 | History; Git diff | Native URLSession callbacks are serialized; empty responses, aborts and stream chunk races are corrected. UTF-8 TextDecoder now carries partial sequences/BOM state; Blob bridges RN data. DOM webview resends props on DOM-ready; dynamic imports return promises; JSI scheduler uses weak lifetimes; optional Scene support and bundle URL handling change. Check article webview, streaming, images, reload and deep links. |
expo-apple-authentication |
57.0.0 → 57.0.2 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-application |
57.0.0 → 57.0.3 | History; Git diff | Adds opt-in provisioning profile expiration query, unused by Folo; build/SPM alignment. Check native startup. |
expo-background-task |
57.0.2 → 57.0.19 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-blur |
57.0.0 → 57.0.3 | History; Git diff | Corrects Android view-order lookup, relevant to overlay/gesture hierarchy. Check blurred modal and interactions. |
expo-build-properties |
57.0.3 → 57.0.21 | History; Git diff | Optional Scene configuration and Expo native build-property alignment. Folo does not opt into Scene changes. Check generated native configuration and builds. |
expo-clipboard |
57.0.0 → 57.0.2 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-constants |
57.0.3 → 57.0.19 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-dev-client |
57.0.5 → 57.0.19 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-device |
57.0.0 → 57.0.2 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-document-picker |
57.0.0 → 57.0.2 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-file-system |
57.0.0 → 57.0.7 | History; Git diff | Android SAF cached lengths/rename and legacy UTF-8 range reads; iOS read permissions and edited iCloud PHAsset resource resolution. Check downloaded/exported media and file imports. |
expo-glass-effect |
57.0.0 → 57.0.3 | History; Git diff | Tint color accepts ColorValue; OS capability helper updates. Check native control color/appearance. |
expo-haptics |
57.0.0 → 57.0.3 | History; Git diff | Android feedback is dispatched on the main queue. Check actions that emit haptics. |
expo-image |
57.0.0 → 57.0.5 | History; Git diff | Glide invalid cache entries are deleted before replacement; native imageLoaded listeners are gated. Optional Expo Observe emits sanitized URLs (credentials removed, queries off; personal-photo schemes excluded). Check image loading/cache and error fallbacks. |
expo-image-manipulator |
57.0.2 → 57.0.19 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-image-picker |
57.0.2 → 57.0.19 | History; Git diff | JPEG base64 consistency, nil crop failure rejection and video fast path authorization. Check image selection/cancel and avatars. |
expo-linear-gradient |
57.0.0 → 57.0.2 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-linking |
57.0.2 → 57.0.10 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-localization |
57.0.0 → 57.0.2 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-media-library |
57.0.1 → 57.0.5 | History; Git diff | Android swaps dimensions for 90/270-degree orientation, resolves missing dimensions and loops FileChannel transfer for large files; iOS permits iCloud network reads. Check saved images/video dimensions and gallery permission. |
expo-network |
57.0.0 → 57.0.2 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-notifications |
57.0.3 → 57.0.20 | History; Git diff | Android guards OEM launch-intent failures; iOS token/delegate lifecycle uses synchronized registry snapshots and abort guards. Check launch/notification permission; remote delivery requires platform credentials/device and is recorded separately. |
expo-secure-store |
57.0.0 → 57.0.4 | History; Git diff | Deleting keys commits both legacy and current Android key entries and handles failures. Check sign-out/relaunch and auth persistence. |
expo-sharing |
57.0.3 → 57.0.21 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-splash-screen |
57.0.2 → 57.0.9 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-sqlite |
57.0.0 → 57.0.3 | History; Git diff | CREATE TABLE IF NOT EXISTS is moved outside the version guard to fix first sync/async initialization races; schema unchanged. Check SQLite auth fallback across restart and account switch. |
expo-status-bar |
57.0.0 → 57.0.1 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-store-review |
57.0.0 → 57.0.3 | History; Git diff | Uses foreground scene lookup. Store review prompts remain platform-controlled. |
expo-symbols |
57.0.0 → 57.0.3 | History; Git diff | Fallback symbol styling corrected. Check native symbols in both themes. |
expo-system-ui |
57.0.0 → 57.0.4 | History; Git diff | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
expo-task-manager |
57.0.2 → 57.0.19 | History; Git diff | Task callbacks and one-shot reentrancy/cleanup are corrected. Check background task registration/lifecycle. |
expo-updates |
57.0.6 → 57.0.23 | History; Git diff | Rejects unsafe asset names including slash Unicode forms before filesystem writes/deletes; repairs/skips incomplete launch records; Android atomic embedded registration and correct one-day retention. iOS embedded assets avoid initial copies and support diff bases; scale-index hashes and UTF-8 logging fixed. pending state clears if no new update. Check fresh offline launch, local update bundle/export and reload; signed production delivery is not exercised. |
expo-video |
57.0.0 → 57.0.4 | History; Git diff | Stable iOS object-id locking, idempotent main-thread release/cancellation and Android app-context fallback. Check play/pause, route dismissal and repeated player mount. |
expo-web-browser |
57.0.0 → 57.0.3 | History; Git diff | Rejects when ASWebAuthenticationSession cannot start instead of hanging. Check open/cancel and deep-link auth callback; external identity providers require separate credentials. |
nativewind |
4.2.6 → 4.2.7 | History; Git diff | Paired with css-interop 0.2.7: stable animated interop avoids hook-order changes, unspecified Appearance fallback and box-shadow fallthrough; supports Reanimated 3/4 Babel plugins. Keep Tailwind 3 on mobile. Check themes, conditional animated styles and release transform. |
react-native-edge-to-edge |
1.8.1 → 1.8.2 | History; Git diff | AGP 9 support, splits isEdgeToEdge property/library helpers. Check Android system-bar and keyboard insets. |
react-native-css-interop |
0.2.6 → 0.2.7 | History; Git diff | Stable animated interop fixes conditional hooks; unspecified Appearance falls back and box-shadow style fallthrough corrected; Reanimated Babel compatibility. Check theme changes and animated styles. |
react-native |
0.86.0 → 0.86.3 | History; Git diff | Expo 57 explicitly pairs RN 0.86.3; latest RN 0.87.1 is outside this SDK. Reviewed 0.86.2/0.86.3 release notes and source diff: Hermes 1.17 startup/memory, EventEmitter/native-props locking, Android reentrant Intent dispatch, animated null transform/opacity reset, DOM modal-parent semantics, RCTFont weight zero and Yoga display-contents layout. Check fresh launch, links, animations, modals and list layouts. |
@expo/dom-webview |
57.0.0 → 57.0.1 | History; Git diff | No formal changelog. Reviewed exact published-source diff and release commit history: package/build version changes only; no runtime changes. Check WebView article rendering. |
react-native-safe-area-context |
5.8.0 → 5.10.0 | History; Git diff | Fabric detachment preserves insets, Yoga updates edge props without overwriting dynamic styles, web nested-provider rect/ResizeObserver cleanup, ref forwarding and AGP 9. Check notches, headers, modals and keyboard. |
react-native-volume-manager |
2.0.8 → 2.2.0 | History; Git diff | Android handles volume keys only while native volume UI is hidden; guards context/window focus and cleans listeners. Java 17/react-android/AGP9 changes; iOS unchanged. Check video volume lifecycle. |
react-native-keyboard-controller |
1.22.0 → 1.22.5 | History; Git diff | Native weak/null teardown guards, UTF-16/nil input handling; tracks all extender views and recycle state. Corrects user-driven animation/layout synchronization, OTP selection y=0, stale target, initial chat offset and interactive dismiss. Reanimated event refs and deferred registration cleanup. Check auth/search/composer inputs, keyboard drag dismissal, focus and route transitions. |
react-native-uikit-colors |
0.6.2 → 1.0.0 | History; Git diff | No formal changelog/release; reviewed release commit history and consumed source across all three packages. React Native hooks and core palette values are unchanged, but its published dependency tailwindcss-uikit-colors changes nine alpha colors from rgba(var(...)) to color-mix(...). Actual native compilation dropped all nine declarations. The native config now uses separate RGB/alpha variables from the official dynamic palette and multiplies utility opacity with calc(); tested all nine classes plus /50, and actual native resolver values in light/dark. See the alpha regression evidence below. |
react-native-pager-view |
8.0.3 → 9.0.4 | History; Git diff | Android 9 replaces ViewPager2 with Compose Horizontal/VerticalPager and stable per-view LifecycleOwner; preserves retained screens through fragment detach, translates scroll/selection/state events and nested gestures. iOS propagates safe areas from UIKit, rotates vertical pager, emits initial selection and waits for modal transitions before animated setPage. Check tabs, image viewer, swipe, programmatic page changes, modal return and nested scroll on both platforms. |
react-native-screens |
4.25.2 → 4.28.0 | History; Git diff | 4.28 requires New Architecture/RN84+, satisfied by RN86. Reviewed stable-v4 JS/Fabric, iOS Screen/Stack/Header/ContentWrapper/traits, Android Screen/Stack/Header/sheet/safearea and C++ removal/geometry diffs. Synchronous shadow/header updates default on; iOS snapshots stay inside original dismissed view to prevent touch-blocking ghost views; orientation inherits parent; obsolete transition flags always on. Android sheet/IME animations coordinate, listeners clean up, stable C++ callback ownership prevents teardown races; header inset/transparent geometry and transition finalization change. New v5/experimental navigation APIs are unused. Check push/pop/swipe, repeated modal open/close, touch responsiveness, keyboard, safe areas and orientation. |
Application changes
- Better Auth Expo 1.7 uses asynchronous cookie reads. Awaited API-client headers, retry, login/migration and debug reads. Account unlink now sends the database account ID; backend translates legacy clients under the authenticated user.
- Reused the official Better Auth asynchronous storage adapter for serialized UTF-8 chunk writes. The cookie observer understands both legacy count-only chunks and new slot/fallback markers, so incomplete writes do not trigger false account changes.
- Added a dual-slot interruption/recovery regression test. Targeted cookie/migration tests: 14 passed in two files.
Validation ledger
Native Release builds and the final Android/iOS authentication, content and theme journeys have passed on isolated local services. See the Android verification, iOS verification and animation compatibility review for exact artifacts and actions. The separate iOS 18.5 local StoreKit check also passed through actual expo-iap cancellation, retry, server verification, transaction finishing and restore; independent database reads confirmed one Xcode subscription with correct ownership and unchanged expiry after restore. External service delivery, real Apple sandbox/production payments and production OTA rollout remain outside these local results.
Compatibility bounds
- React Native stays on the newest Expo-57-supported patch (0.86.3). React is 19.2.8 throughout the frontend workspace to avoid a second renderer/hook runtime; 19.3 is not in this native renderer compatibility line.
- Babel stays on the newest 7.x line consumed by Expo 57. NativeWind 4 uses mobile Tailwind 3; desktop Tailwind upgrades are independent.
- Firebase, purchase/analytics SDKs, Gesture Handler, Reanimated and Worklets are audited in companion reports before installation.
UIKit alpha regression and continuous test coverage
The initial review was too narrow: react-native-uikit-colors/tailwind re-exports its sibling tailwindcss-uikit-colors, so that sibling is consumed runtime. A follow-up read covered the full generate-tailwind-config.ts and src/tailwind.ts changes between the exact refs linked above, and checked the published 0.6.2/1.0.0 tarballs. The generator deliberately replaced rgba(var(...)) with color-mix(...) to support opacity modifiers. Core Apple palette values and native hooks are unchanged. This is an upgrade regression, rather than an existing color defect.
Counterfactual compilation against the same installed Tailwind 3 / CSSInterop 0.2.7 toolchain produced 9/9 declarations with published UIKit 0.6.2, 0/9 with unadapted 1.0.0, and 9/9 after adaptation. withNativeUIKit replaces only the nine dynamic alpha-color entries; RootProviders supplies numeric RGB and intrinsic-alpha variables from useColorsVariants, retaining the official light/dark palette. Native rgb and calc support opacity multiplication without color-mix or hardcoded substitute colors.
The regression tests compile all nine semantic classes with and without /50. They also run the actual published CSSInterop native resolveValue implementation with mocked platform services: separator resolves to alpha 0.34/0.6, system fill /50 to 0.1/0.18, and secondary label to the official light/dark RGB with alpha 0.6. Evidence: /tmp/folo-uikit-alpha-audit/{consumed-source.diff,compile-comparison.log} and apps/mobile/scripts/uikit-colors.test.ts. Final simulator screenshots and theme interactions are recorded in the native platform reports.
The mobile and HTML-renderer packages now expose their existing Vitest configurations through scripts.test, so root recursive tests include their auth, purchase, migration and reader regressions. Existing TTS/spotlight tests use the Vitest runner, release-script tests resolve fixtures from their own file URL, and GitHub-output assertions check the existing delimiter format. These changes fix test discovery/cwd assumptions without changing release scripts.
Final Node 24 / pnpm 12 checks passed: mobile typecheck; lint with no errors; the complete mobile suite (35 files, 152 tests); HTML renderer (2 files, 12 tests); root recursive test command (130 files, 688 passed, 2 existing CLI skips). Logs: /tmp/folo-frontend-final-{typecheck,lint,test,format}.log. The migration snapshot/multiple-subscriber regression and UIKit tests are included in this count.
Dev build workflow follow-up
The first published dev SHA passed local native acceptance but exposed a clean-runner Expo configuration failure before native compilation. The workflow HTML assets path resolved to apps/out instead of repository-root out. The fallback renderer build then inherited conflicting pnpm 12 linker overrides and automatically replaced modules inside the active Expo process. All six mobile build jobs now use an absolute repository-root output path and the same hoisted workspace layout throughout. The exact failure evidence, install recovery and validation boundary are recorded in the pnpm audit. This is build-environment repair; application code and reviewed dependency versions are unchanged.