Skip to content

chore(deps): bump js-yaml and react-native in /test-projects/expo-purchasely-test#251

Merged
kherembourg merged 1 commit into
mainfrom
dependabot/npm_and_yarn/test-projects/expo-purchasely-test/multi-f95bca4a68
Jun 16, 2026
Merged

chore(deps): bump js-yaml and react-native in /test-projects/expo-purchasely-test#251
kherembourg merged 1 commit into
mainfrom
dependabot/npm_and_yarn/test-projects/expo-purchasely-test/multi-f95bca4a68

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 16, 2026

Copy link
Copy Markdown
Contributor

Bumps js-yaml to 4.2.0 and updates ancestor dependency react-native. These dependencies need to be updated together.

Updates js-yaml from 4.1.1 to 4.2.0

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3
Commits

Updates react-native from 0.81.5 to 0.86.0

Release notes

Sourced from react-native's releases.

0.86.0

Added

  • Accessibility: AccessibilityInfo: added missing tests for Promise based methods, align null checks and error message code style (8fc503d780 by @​chicio)
  • Animated: Suspense tests for the Animation Backend (8101fc776d by Bartlomiej Bloniarz)
  • Animated: Use weak_ptr when calling pullAnimationMutations in a callback scheduled with the Animation Backend (42d98b5830 by Bartlomiej Bloniarz)
  • Dev Server: Call methods on global.__BUNDLE_LOADER_REPORTER__, if given, during dev-mode bundler loads from Metro (1e0c1f886b by @​robhogan)
  • React Native DevTools: Add new custom track for React Native Renderer operations in React Native DevTools performance traces (0b1def9ce5, 29bc8f1acb, 9130df6773, c26a4875ea by @​rubennorte)
  • React Native DevTools: Add support for light/dark mode emulation via Emulation.setEmulatedMedia (11a5432cb2 by @​huntie)
  • Runtime: Add unstable_getViewTransitionInstance to UIManagerBinding (d8820a403b by @​zeyap)
  • Runtime: Add UIManagerViewTransitionDelegate interface and View Transition APIs (cdad57d8f1 by @​zeyap)
  • Runtime: Add viewport size to LayoutContext (d38c756529 by @​paradowstack)
  • Runtime: ViewTransitionModule for React Native View Transitions (f81f73e5a0 by @​zeyap)
  • Text: Add E2E tests for Text boxShadow and textWithLinkRole (b172f46f0d by @​NickGerleman)
  • View: Add E2E tests for Filter blur-with-overflow, drop-shadow, and animated-blur (66975aa3d5 by @​NickGerleman)
  • View: Add mixBlendMode plus-lighter (aaa0684045 by @​bigcupcoffee)

Android specific

iOS specific

  • Build: Add privacy manifest to declare the use of mach_absolute_time() API in the React-timing module (2ae6c8940d by @​rubennorte)
  • Dev Server: Introduce isPackagerRunningAsync that does not block the UI thread waiting on the request to DevServer ("Packager") validating that it is running (dd056d9b4c by @​vzaidman)
  • Image: Add E2E tests for Image visual examples (48b6f2dcc9 by @​NickGerleman)
  • Networking: Add RCTSetCustomMultipartDataTaskRequestInterceptor API to allow custom modification of multipart data task requests before they are sent (59b8886bb8 by @​cipolleschi)

Changed

  • Build: Update Metro to ^0.84.2 (57d4b6b350 by @​robhogan)
  • Dev Server: LoadBundleFromServer test: remove legacy Jest timers, increased coverage and improved assertions (a19d98e542 by @​chicio)
  • Hermes: Bump hermes-compiler dependency (031168013e by @​robhogan)
  • Hermes: Bump hermes version (89a2a20739 by @​robhogan)
  • LogBox: Migrated LogBoxData tests to Jest modern timers (dea2136a49 by @​chicio)
  • React: Make React Native consume 250829098.0.11 (26953d8343 by @​alanleedev)
  • React Native DevTools: Derive WebSocket scheme and port from dev server URL for React DevTools connections, supporting HTTPS dev servers (ca4173701d by @​cipolleschi)
  • Runtime: Measure node instance during applyViewTransitionName (d17ecca3c9 by @​zeyap)
  • Runtime: Move ViewTransition APIs not for react reconciler to its own TurboModule (0e65df9152 by @​zeyap)
  • Runtime: Setting reportErrorsAsExceptions to anything other than false no longer does anything. (Previously, setting it to a falsey value would be similar to setting it to false.) (f0748a6387 by @​yungsters)
  • Runtime: Use getNullableViewState in SurfaceMountingManager::updateProps and log a soft exception instead (bbf7004935 by Bartlomiej Bloniarz)

... (truncated)

Changelog

Sourced from react-native's changelog.

v0.86.0

Added

  • Accessibility: AccessibilityInfo: added missing tests for Promise based methods, align null checks and error message code style (8fc503d780 by @​chicio)
  • Animated: Suspense tests for the Animation Backend (8101fc776d by Bartlomiej Bloniarz)
  • Animated: Use weak_ptr when calling pullAnimationMutations in a callback scheduled with the Animation Backend (42d98b5830 by Bartlomiej Bloniarz)
  • Dev Server: Call methods on global.__BUNDLE_LOADER_REPORTER__, if given, during dev-mode bundler loads from Metro (1e0c1f886b by @​robhogan)
  • React Native DevTools: Add new custom track for React Native Renderer operations in React Native DevTools performance traces (0b1def9ce5, 29bc8f1acb, 9130df6773, c26a4875ea by @​rubennorte)
  • React Native DevTools: Add support for light/dark mode emulation via Emulation.setEmulatedMedia (11a5432cb2 by @​huntie)
  • Runtime: Add unstable_getViewTransitionInstance to UIManagerBinding (d8820a403b by @​zeyap)
  • Runtime: Add UIManagerViewTransitionDelegate interface and View Transition APIs (cdad57d8f1 by @​zeyap)
  • Runtime: Add viewport size to LayoutContext (d38c756529 by @​paradowstack)
  • Runtime: ViewTransitionModule for React Native View Transitions (f81f73e5a0 by @​zeyap)
  • Text: Add E2E tests for Text boxShadow and textWithLinkRole (b172f46f0d by @​NickGerleman)
  • View: Add E2E tests for Filter blur-with-overflow, drop-shadow, and animated-blur (66975aa3d5 by @​NickGerleman)
  • View: Add mixBlendMode plus-lighter (aaa0684045 by @​bigcupcoffee)

Android specific

iOS specific

  • Build: Add privacy manifest to declare the use of mach_absolute_time() API in the React-timing module (2ae6c8940d by @​rubennorte)
  • Dev Server: Introduce isPackagerRunningAsync that does not block the UI thread waiting on the request to DevServer ("Packager") validating that it is running (dd056d9b4c by @​vzaidman)
  • Image: Add E2E tests for Image visual examples (48b6f2dcc9 by @​NickGerleman)
  • Networking: Add RCTSetCustomMultipartDataTaskRequestInterceptor API to allow custom modification of multipart data task requests before they are sent (59b8886bb8 by @​cipolleschi)

Changed

... (truncated)

Commits
  • a632f9e Release 0.86.0
  • 012be3b Release 0.86.0-rc.3
  • cd5b3b5 Bump Hermes V1 version to 250829098.0.14
  • 19da7bb Release 0.86.0-rc.2
  • cc27962 fix(cocoapods): escape local file URIs for unicode paths (#56907)
  • 6c6511c feat(Pressable): add support for PlatformColor and alpha (#56395)
  • f2880fd Cache prebuilt iOS binaries in ~/Library/Caches/ReactNative (#56847)
  • 443ac40 fix(cocoapods) Podfile.lock SPEC CHECKSUMS drift for React XCFrameworks (#56803)
  • ff2562e fix(ios): load RCTDefines.h first in React umbrella + drop submodule wildcard...
  • 94b6bcb Release 0.86.0-rc.1
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.2.0 and updates ancestor dependency [react-native](https://github.com/facebook/react-native/tree/HEAD/packages/react-native). These dependencies need to be updated together.


Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `react-native` from 0.81.5 to 0.86.0
- [Release notes](https://github.com/facebook/react-native/releases)
- [Changelog](https://github.com/react/react-native/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react-native/commits/v0.86.0/packages/react-native)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: indirect
- dependency-name: react-native
  dependency-version: 0.86.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 16, 2026
@greptile-apps

greptile-apps Bot commented Jun 16, 2026

Copy link
Copy Markdown

PR author is in the excluded authors list.

Copy link
Copy Markdown

Automated Dependabot Review — 2026-06-16

Scope: /test-projects/expo-purchasely-test only — does not affect the main SDK packages.

Packages

Package Change Bump Notes
js-yaml 4.1.1 → 4.2.0 minor Security: DoS fix for quadratic merge complexity. Safe.
react-native 0.81.5 → 0.86.0 major 5 minor versions. New Architecture became default in 0.84. Test project may need config updates.
@react-native/metro-config 0.79.2 → 0.86.0 major Aligned with react-native version.

CI at time of review

  • lint ✅ — test ✅ — build-android ⏳ — build-ios ⏳

Recommendation

Wait for CI. If build-android and build-ios pass → safe to merge (test project only). If they fail → decide whether to fix or close.

@kherembourg — for your attention.


Generated by automated Dependabot review routine


Generated by Claude Code

@kherembourg kherembourg merged commit 6110632 into main Jun 16, 2026
4 checks passed
@kherembourg kherembourg deleted the dependabot/npm_and_yarn/test-projects/expo-purchasely-test/multi-f95bca4a68 branch June 16, 2026 09:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants