From 56fd50988cde6d81240bd8fb492944d681c11d9e Mon Sep 17 00:00:00 2001 From: LiuJing Date: Tue, 8 Sep 2026 03:40:30 +0800 Subject: [PATCH] fix(plugin): loosen the react peer to ~19.1.0 (#4100) * fix(plugin): loosen the react peer to ~19.1.0 The plugin SDK pins its react peer to exactly 19.1.0, and that pin is what a downstream `npm i -g @getpaseo/cli` resolves against. So every user ends up with react 19.1.0 in their global node_modules, where corporate dependency scanners flag it: the CVE-2025-55182 advisory range covers 19.1.0 even though the vulnerability itself lives in react-server-dom-webpack/-parcel/-turbopack, none of which the CLI installs. The user is then left hand-patching node_modules or uninstalling Paseo. Widening the peer to ~19.1.0 lets a downstream install pick the latest 19.1.x patch (19.1.9 today) while this repo stays on 19.1.0, which the root override still pins. Keeping the repo itself on 19.1.0 is deliberate. react-native 0.81.5 embeds a 19.1.0 Paper renderer that hard-throws "Incompatible React versions" on any exact mismatch, and it is reachable from Fabric builds too: RendererImplementation.js requires the Paper shim unconditionally in findNodeHandle, unstable_batchedUpdates, sendAccessibilityEvent and three other entry points, and react-native-gesture-handler re-exports findNodeHandle. Bumping the app's react is therefore not safe until react-native moves. The published CLI tree contains no react-native, so downstream installs are not subject to that constraint. Supersedes the earlier 19.1.5/19.1.9 version-bump approach on this branch, which would have broken the mobile app. * Update Nix dependency hash for plugin peer metadata --------- Co-authored-by: Mohamed Boudra --- nix/npm-deps.hash | 2 +- package-lock.json | 2 +- packages/plugin/package.json | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/nix/npm-deps.hash b/nix/npm-deps.hash index 96f8a0393a..bbf576be8a 100644 --- a/nix/npm-deps.hash +++ b/nix/npm-deps.hash @@ -1 +1 @@ -sha256-1MBzb+r/t92G9uR/jBuc3oNEfEloHeRg9uUgzSHS4UM= +sha256-zpE2CbXKy0D4tsYdeBo7JiNBNxSnB1JlnS3PtCmXKiw= diff --git a/package-lock.json b/package-lock.json index 4eb14395e7..9fb68d487a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -38715,7 +38715,7 @@ "peerDependencies": { "@getpaseo/client": "0.7.2", "@getpaseo/protocol": "0.7.2", - "react": "19.1.0", + "react": "~19.1.0", "react-native": ">=0.81.5", "zod": "^4.4.3" }, diff --git a/packages/plugin/package.json b/packages/plugin/package.json index 34b481ffda..52fb25aca0 100644 --- a/packages/plugin/package.json +++ b/packages/plugin/package.json @@ -73,7 +73,7 @@ "peerDependencies": { "@getpaseo/client": "0.7.2", "@getpaseo/protocol": "0.7.2", - "react": "19.1.0", + "react": "~19.1.0", "react-native": ">=0.81.5", "zod": "^4.4.3" },