Bump undici, @react-native-firebase/app and @react-native-firebase/messaging - #6134
Bump undici, @react-native-firebase/app and @react-native-firebase/messaging#6134dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 04df596. Configure here.
| "@react-native-firebase/app": "^20.5.0", | ||
| "@react-native-firebase/messaging": "^20.5.0", | ||
| "@react-native-firebase/app": "^26.1.0", | ||
| "@react-native-firebase/messaging": "^26.1.0", |
There was a problem hiding this comment.
Firebase v26 needs New Architecture
High Severity
Updating @react-native-firebase/app and @react-native-firebase/messaging to 26.1.0 requires React Native New Architecture. With newArchEnabled=false on Android, messaging TurboModules won't load, which breaks FCM token registration, push handling, and deep links.
Reviewed by Cursor Bugbot for commit 04df596. Configure here.
| "@react-native-firebase/app": "^20.5.0", | ||
| "@react-native-firebase/messaging": "^20.5.0", | ||
| "@react-native-firebase/app": "^26.1.0", | ||
| "@react-native-firebase/messaging": "^26.1.0", |
There was a problem hiding this comment.
Android Firebase messaging pin stale
High Severity
The @react-native-firebase update to 26.1.0 in package.json creates native dependency version mismatches. On Android, android/app/build.gradle hardcodes firebase-messaging:23.0.0, conflicting with the newer Firebase Android SDK pulled by RNFB 26.1.0, which may cause dependency conflicts or native API skew for MessagesWorker. On iOS, ios/Podfile.lock retains older RNFB (20.5.0) and Firebase iOS (10.29.0) versions, leading to a mixed JS/native Firebase stack and potential Xcode build issues.
Reviewed by Cursor Bugbot for commit 04df596. Configure here.
| "@react-native-firebase/app": "^20.5.0", | ||
| "@react-native-firebase/messaging": "^20.5.0", | ||
| "@react-native-firebase/app": "^26.1.0", | ||
| "@react-native-firebase/messaging": "^26.1.0", |
There was a problem hiding this comment.
Namespaced messaging API removed
High Severity
The upgrade to RN Firebase v26 removes namespaced default exports, but the app still uses import messaging from '@react-native-firebase/messaging' and messaging().getToken() / messaging().onMessage(). Those call sites were not migrated to modular helpers like getMessaging and getToken.
Reviewed by Cursor Bugbot for commit 04df596. Configure here.
…ssaging Bumps [undici](https://github.com/nodejs/undici) to 6.28.0 and updates ancestor dependencies [undici](https://github.com/nodejs/undici), [@react-native-firebase/app](https://github.com/invertase/react-native-firebase) and [@react-native-firebase/messaging](https://github.com/invertase/react-native-firebase). These dependencies need to be updated together. Updates `undici` from 6.21.3 to 6.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.21.3...v6.28.0) Updates `@react-native-firebase/app` from 20.5.0 to 26.1.0 - [Release notes](https://github.com/invertase/react-native-firebase/releases) - [Changelog](https://github.com/invertase/react-native-firebase/blob/main/CHANGELOG.md) - [Commits](invertase/react-native-firebase@v20.5.0...v26.1.0) Updates `@react-native-firebase/messaging` from 20.5.0 to 26.1.0 - [Release notes](https://github.com/invertase/react-native-firebase/releases) - [Changelog](https://github.com/invertase/react-native-firebase/blob/main/CHANGELOG.md) - [Commits](invertase/react-native-firebase@v20.5.0...v26.1.0) --- updated-dependencies: - dependency-name: "@react-native-firebase/app" dependency-version: 26.1.0 dependency-type: direct:production - dependency-name: "@react-native-firebase/messaging" dependency-version: 26.1.0 dependency-type: direct:production - dependency-name: undici dependency-version: 6.28.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
04df596 to
dc24676
Compare
Bumps undici to 6.28.0 and updates ancestor dependencies undici, @react-native-firebase/app and @react-native-firebase/messaging. These dependencies need to be updated together.
Updates
undicifrom 6.21.3 to 6.28.0Release notes
Sourced from undici's releases.
... (truncated)
Commits
01a912eBumped v6.28.0 (#5591)481ecfcUse Node 22 and npm 11 to release740a0b7fix: validate blob body content type2698e49fix: validate coerced header values for CRLF (#5579)4fd5a0ctest(retry): correct broken content-range fixtures in retry-handler.jscba3a52fix(retry): reject partial content length mismatchaf74840fix: harden cookie domain, path, and unparsed attribute validation551138cBumped v6.27.0 (#5431)b7f252eBackport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)25efa44fix(cookies): preserve values and parse SameSite strictlyMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.
Updates
@react-native-firebase/appfrom 20.5.0 to 26.1.0Release notes
Sourced from @react-native-firebase/app's releases.
... (truncated)
Changelog
Sourced from @react-native-firebase/app's changelog.
... (truncated)
Commits
59d053echore(release): release packages3ebbea6build(deps): bump actions/stale from 10.3.0 to 10.4.0 (#9120)a33867efeat(auth, ios): add fullName support for Sign in with Apple credentials (#9096)64646f3fix(app, sdks): adopt native SDK ios 12.17.0, android 34.16.0, js 12.17.0 (#9...2d73cdctest(ci): unique-ify secondary app names in tests (#9139)44a7a9afeat(ios): add SPM dependency resolution support alongside CocoaPods (#8933)d74b550fix(auth, app): fix web auth initialization crash and missing methods (#9134)99af959feat(messaging): make expo plugin configurable for notification icon and colo...a1e9ffefix(firestore): serverTimestamps implement correct behavior for 'estimate' | ...2a360acchore(release): release packagesMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@react-native-firebase/appsince your current version.Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
@react-native-firebase/messagingfrom 20.5.0 to 26.1.0Release notes
Sourced from @react-native-firebase/messaging's releases.
... (truncated)
Changelog
Sourced from @react-native-firebase/messaging's changelog.
... (truncated)
Commits
59d053echore(release): release packages3ebbea6build(deps): bump actions/stale from 10.3.0 to 10.4.0 (#9120)a33867efeat(auth, ios): add fullName support for Sign in with Apple credentials (#9096)64646f3fix(app, sdks): adopt native SDK ios 12.17.0, android 34.16.0, js 12.17.0 (#9...2d73cdctest(ci): unique-ify secondary app names in tests (#9139)44a7a9afeat(ios): add SPM dependency resolution support alongside CocoaPods (#8933)d74b550fix(auth, app): fix web auth initialization crash and missing methods (#9134)99af959feat(messaging): make expo plugin configurable for notification icon and colo...a1e9ffefix(firestore): serverTimestamps implement correct behavior for 'estimate' | ...2a360acchore(release): release packagesMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@react-native-firebase/messagingsince your current version.Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Note
High Risk
Major jump in Firebase/RN Firebase versions affects push notifications and deep links, and v26 messaging expects New Architecture while the repo currently disables it on Android.
Overview
This PR only updates
package.jsonandpackage-lock.json:@react-native-firebase/appand@react-native-firebase/messagingmove from 20.5.0 to 26.1.0, which pullsfirebase12.17.0 (from 10.12.2) and dropssuperstructfrom the RN Firebase app package. Transitiveundiciis bumped to 6.28.0 (security fixes in the lockfile).There are no application source changes; push handling still goes through
NotificationActionsandDeepLinkingManagervia@react-native-firebase/messaging.Review focus: RN Firebase v26 requires React Native New Architecture for messaging (TurboModules), while
android/gradle.propertiesstill hasnewArchEnabled=false. Confirm New Architecture is enabled on both platforms (and native builds are refreshed) before relying on this bump. Also note the v26prepareinstall script change mentioned in the PR description.Reviewed by Cursor Bugbot for commit dc24676. Bugbot is set up for automated code reviews on this repo. Configure here.