Skip to content

[Snyk] Security upgrade expo from 54.0.36 to 55.0.25 - #7543

Open
ggazzo wants to merge 1 commit into
developfrom
snyk-fix-b1272a2edb69ad22d8ed04c59ac28328
Open

[Snyk] Security upgrade expo from 54.0.36 to 55.0.25#7543
ggazzo wants to merge 1 commit into
developfrom
snyk-fix-b1272a2edb69ad22d8ed04c59ac28328

Conversation

@ggazzo

@ggazzo ggazzo commented Aug 3, 2026

Copy link
Copy Markdown
Member

snyk-top-banner

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

  • package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning
Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

Issue
medium severity Directory Traversal
SNYK-JS-POSTCSS-18512282

Breaking Change Risk

Merge Risk: High

Notice: This assessment is enhanced by AI.


Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-POSTCSS-18512282
@ggazzo

ggazzo commented Aug 3, 2026

Copy link
Copy Markdown
Member Author

Merge Risk: High

The upgrade to Expo SDK 55 is a major version update that introduces significant breaking changes requiring developer action.

Key Breaking Changes:

  • New Architecture is Now Mandatory: Support for the legacy architecture has been completely removed. Projects must be migrated to the New Architecture to use SDK 55.
  • expo-av Package Removed: The expo-av package has been removed. Code using this package for audio or video playback must be migrated to the newer expo-audio and expo-video packages.
  • Core Dependency Upgrades: This SDK version incorporates React Native 0.83 and React 19, which may have their own breaking changes.

Recommendation: This upgrade requires significant migration effort. Developers must ensure their application is already using Expo's New Architecture and replace all instances of expo-av with the new expo-audio and expo-video APIs. Due to the scale of these changes, a thorough review and testing cycle is essential.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

@ggazzo
ggazzo requested a deployment to approve_e2e_testing August 3, 2026 21:01 — with GitHub Actions Waiting
@coderabbitai

coderabbitai Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f129dc07-3135-4c24-8ee6-890d4bfc0c16

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants