Skip to content

chore(deps): bump react-native from 0.86.2 to 0.87.0 - #260

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/react-native-0.87.0
Closed

chore(deps): bump react-native from 0.86.2 to 0.87.0#260
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/react-native-0.87.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps react-native from 0.86.2 to 0.87.0.

Release notes

Sourced from react-native's releases.

0.87.0


Hermes V1 dSYMS:

ReactNativeDependencies dSYMs:

ReactNative Core dSYMs:


You can file issues or pick requests against this release here.


To help you upgrade to this version, you can use the Upgrade Helper ⚛️.


View the whole changelog in the CHANGELOG.md file.

0.87.0-rc.4


Hermes V1 dSYMS:

ReactNativeDependencies dSYMs:

ReactNative Core dSYMs:


You can file issues or pick requests against this release here.


... (truncated)

Changelog

Sourced from react-native's changelog.

v0.87.0

Breaking

  • Appearance: Fix return type of useColorScheme() hook (now ColorSchemeName | null) (ef6463c25d by @​huntie)
  • Appearance: useColorScheme() no longer returns 'unspecified' (this was always the case, but is a breaking type change) (8ac88f481a by @​huntie)
  • CLI: The react-native/core-cli-utils package is no longer published. It remains available in the React Native repo as a reference implementation. (9c3fddf9cd by @​huntie)
  • Hermes: Remove Legacy Hermes from C++ code (f9476256bd by @​cipolleschi)
  • JavaScript API: Deep imports to 'react-native/src/private/...' have been restricted, and are no longer visible to TypeScript. These subpaths still exist, but do not have type coverage. (142b6172a9 by @​huntie)
  • JavaScript API: The NativeDialogManagerAndroid export is removed. (a793d21a7e by @​huntie)
  • JavaScript API: The Touchable root export (undocumented) is removed. If you are extending Touchable as a type, please use ViewProps instead. (6fbf3062f9 by @​huntie)
  • JavaScript API: react-native/rn-get-polyfills is removed — please use react-native/js-polyfills (package) (b6a535afee by @​huntie)
  • Jest: react-native/jest-preset is removed — all projects must now migrate to react-native/jest-preset (package) (9ee21ddd9b by @​huntie)
  • Legacy Architecture: Compile out RuntimeScheduler_Legacy under RCT_REMOVE_LEGACY_ARCH (d205267a5f by @​christophpurrer)
  • LogBox: Set max font scaling in LogBox to avoid layout breaking (4aef2b0126 by @​pchalupa)
  • Node: Require Node.js >= 22.13.0 (a0d39e7a9c by @​huntie)
  • React Native DevTools: Remove support for connecting to the standalone react-devtools package via WebSocket. Use React Native DevTools instead. (f1971caa44 by @​huntie)
  • Renderer: Remove RawPropsKey prefix and suffix (67381e157f by @​javache)
  • Runtime: Remove the SceneTracker module from Libraries/Utilities, stop setting the active scene from AppRegistry.runApplication, and pass the app key as an optional second argument to WrapperComponentProvider (bbb5be9b41 by @​rubennorte)
  • ScrollView: Remove deprecated boolean values support for ScrollView keyboardShouldPersistTaps (5bf3e38db2 by @​zoontek)
  • StatusBar: Remove deprecated StatusBar backgroundColor / translucent / networkActivityIndicatorVisible props and setBackgroundColor / setTranslucent / setNetworkActivityIndicatorVisible methods (6b45e579d6 by @​zoontek)
  • Strict TypeScript API: Remove legacy NativeMethods and NativeMethodsMixin types (b724611aec by @​huntie)
  • Strict TypeScript API: React Native's default JavaScript API is now the Strict TypeScript API. Use customConditions: ["react-native-legacy-deep-imports"] to opt out. (c948b61c05 by @​huntie)

Android specific

iOS specific

Added

  • Animated: Support native driven AnimatedValue interpolation easing (57ce6bc585 by @​zeyap)
  • Animated: Remove useNativeDriver under featureflag animatedForceNativeDriver (9cf30b6e4b by @​zeyap)
  • Animated: Remove useNativeDriver under featureflag animatedForceNativeDriver (cffe14ff57 by @​zeyap)
  • Animated: Add optimizedAnimatedPropUpdates feature flag (ed96b22af2 by Bartlomiej Bloniarz)
  • Assets: Introduce react-native/asset-utils package (relocates Android path utils for libraries/frameworks) (41d52189e2 by @​huntie)
  • JavaScript API: Deprecate 'react-native/Libraries/Core/InitializeCore'. Use 'react-native/setup-env' instead. (bfa679f0ea by @​huntie)
  • Legacy Architecture: Gate shared C++ and Android Java/Kotlin legacy view manager interop behind RCT_REMOVE_LEGACY_COMPONENT_INTEROP (9885fe95ef by @​christophpurrer)

... (truncated)

Commits
  • 4bc2473 Release 0.87.0
  • 01f752d Release 0.87.0-rc.4
  • 24353da fix(iOS): keep prebuilt Headers/ in place on a Debug/Release swap (#57814)
  • 329f864 fix(swiftpm): persist --config-command so the in-build sync keeps using it (#...
  • 4dd4d31 Write the prebuilt module-map flag to OTHER_CPLUSPLUSFLAGS too (#57742)
  • f3e11c2 Fix compat with extensionless scripts/* imports (#57718)
  • d8b52df SPM: allow overriding the autolinking config command (#57662)
  • 0cacb90 SPM: fix raw Flow type annotations in bare-node scripts (#57660)
  • 034245a fix(iOS): stage Hermes headers in prebuild compose job so ReactNativeHeaders ...
  • b67c5cf Release 0.87.0-rc.3
  • Additional commits viewable in compare view

@dependabot
dependabot Bot requested a review from Medformatik as a code owner August 17, 2026 04:28
@github-actions
github-actions Bot enabled auto-merge (squash) August 17, 2026 04:28
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/react-native-0.87.0 branch 8 times, most recently from b14da81 to c796f08 Compare August 24, 2026 05:31
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/react-native-0.87.0 branch from c796f08 to 7c36644 Compare August 27, 2026 15:37
Bumps [react-native](https://github.com/react/react-native/tree/HEAD/packages/react-native) from 0.86.2 to 0.87.0.
- [Release notes](https://github.com/react/react-native/releases)
- [Changelog](https://github.com/react/react-native/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react-native/commits/v0.87.0/packages/react-native)

---
updated-dependencies:
- dependency-name: react-native
  dependency-version: 0.87.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/react-native-0.87.0 branch from 7c36644 to 6c87fe1 Compare August 27, 2026 17:26
@github-actions

Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ❌ 1 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
  • ⚠️ 1 packages with OpenSSF Scorecard issues.
See the Details below.

Vulnerabilities

pnpm-lock.yaml

NameVersionVulnerabilitySeverity
image-size1.2.1image-size: JXL and HEIF parsers allow denial of service through infinite loopshigh
image-size: ICNS parser allows denial of service through an infinite loophigh
Only included vulnerabilities with severity high or higher.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/react-native 0.87.0 UnknownUnknown
npm/image-size 1.2.1 🟢 3.1
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained⚠️ 0project is archived
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
SAST⚠️ 0no SAST tool detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
npm/@react-native/asset-utils 0.87.0 UnknownUnknown
npm/@react-native/codegen 0.87.0 UnknownUnknown
npm/@react-native/community-cli-plugin 0.87.0 UnknownUnknown
npm/@react-native/debugger-frontend 0.87.0 UnknownUnknown
npm/@react-native/debugger-shell 0.87.0 UnknownUnknown
npm/@react-native/dev-middleware 0.87.0 UnknownUnknown
npm/@react-native/gradle-plugin 0.87.0 UnknownUnknown
npm/@react-native/normalize-colors 0.87.0 UnknownUnknown
npm/@react-native/virtualized-lists 0.87.0 UnknownUnknown
npm/metro 0.87.0 UnknownUnknown
npm/metro-babel-transformer 0.87.0 UnknownUnknown
npm/metro-cache 0.87.0 UnknownUnknown
npm/metro-cache-key 0.87.0 UnknownUnknown
npm/metro-config 0.87.0 UnknownUnknown
npm/metro-core 0.87.0 UnknownUnknown
npm/metro-file-map 0.87.0 UnknownUnknown
npm/metro-minify-terser 0.87.0 UnknownUnknown
npm/metro-resolver 0.87.0 UnknownUnknown
npm/metro-runtime 0.87.0 UnknownUnknown
npm/metro-source-map 0.87.0 UnknownUnknown
npm/metro-symbolicate 0.87.0 UnknownUnknown
npm/metro-transform-plugins 0.87.0 UnknownUnknown
npm/metro-transform-worker 0.87.0 UnknownUnknown
npm/ob1 0.87.0 UnknownUnknown
npm/queue 6.0.2 ⚠️ 2.9
Details
CheckScoreReason
Pinned-Dependencies⚠️ -1no dependencies found
Binary-Artifacts🟢 10no binaries found in the repo
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 6Found 10/16 approved changesets -- score normalized to 6
Token-Permissions⚠️ -1No tokens found
Dangerous-Workflow⚠️ -1no workflows found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
Signed-Releases⚠️ -1no releases found
License🟢 10license file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/react-native 0.87.0 UnknownUnknown

Scanned Files

  • apps/mobile/package.json
  • pnpm-lock.yaml

@Medformatik

Copy link
Copy Markdown
Collaborator

Not safe independently. Expo 57 currently owns React Native 0.86.2 and the matching @react-native/jest-preset; this PR’s 0.87.0 bump breaks mobile resolution/types/tests and Docker builds. PR #227 now adds a dependency-policy guard so React Native moves only with a reviewed Expo SDK upgrade.

auto-merge was automatically disabled August 27, 2026 20:30

Pull request was closed

@dependabot @github

dependabot Bot commented on behalf of github Aug 27, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@github-actions github-actions Bot locked and limited conversation to collaborators Aug 27, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/react-native-0.87.0 branch August 27, 2026 20:30
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant