fix(macos): merge upstream-macos/main into 0.85 fork - #1
Merged
christopherwxyz merged 59 commits intoJul 16, 2026
Conversation
…icrosoft#2945) ## Summary - Re-applies the fix from microsoft#2820 that was inadvertently reverted in microsoft#2917 - In pnpm setups, `@react-native-community/cli-platform-apple` is a transitive dependency of `cli-platform-ios` and not directly resolvable from the project root — resolve `cli-platform-ios` first and use its path as the starting directory Fixes microsoft#2944 ## Test plan - Verified in a pnpm monorepo that `cli-platform-apple` resolves correctly and the `macos` platform is registered 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.1.0 to 10.1.1. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/beaugunderson/ip-address/commits">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/react-native-macos/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary: CI is failing because of fmt's version, bumping Xcode to 26.2 should fix it ## Test Plan: CI should be green
## Summary: We've started to use intermediate `*-merge` branches, so let's have CI run on them too. They won't block merging if they fail since these are working branches.
…icrosoft#2968) Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) from 5.2.3 to 5.2.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack-dev-server/releases">webpack-dev-server's releases</a>.</em></p> <blockquote> <h2>v5.2.4</h2> <h3><a href="https://github.com/webpack/webpack-dev-server/compare/v5.2.3...v5.2.4">5.2.4</a> (2026-05-11)</h3> <h3>Bug Fixes</h3> <ul> <li>set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md">webpack-dev-server's changelog</a>.</em></p> <blockquote> <h3><a href="https://github.com/webpack/webpack-dev-server/compare/v5.2.3...v5.2.4">5.2.4</a> (2026-05-11)</h3> <h3>Bug Fixes</h3> <ul> <li>set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpack/webpack-dev-server/commit/fd401308f1cc026262880e2dab810004d6444282"><code>fd40130</code></a> chore(release): 5.2.4</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/ece4f3617bea31fb6d3833f69a32b6c289959a49"><code>ece4f36</code></a> chore: update deps (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5661">#5661</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/a2161442a314a06a97e25d1404d08410cb4e9c51"><code>a216144</code></a> ci: fix test (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5658">#5658</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/df073c53a8cefb54210b43813fa6ee60364a554e"><code>df073c5</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/webpack/webpack-dev-server/compare/v5.2.3...v5.2.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/react-native-macos/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…crosoft#2966) Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.5 to 5.0.6. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/46317b5d8779c151d24f65c9c139cd076f91a1c3"><code>46317b5</code></a> 5.0.6</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5"><code>c0b095b</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/ec5602085a81ca7c954f6780c6a3aef0b1e200cf"><code>ec56020</code></a> Bump picomatch from 4.0.3 to 4.0.4 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/93">#93</a>)</li> <li>See full diff in <a href="https://github.com/juliangruber/brace-expansion/compare/v5.0.5...v5.0.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/react-native-macos/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#2975) Bumps [postcss](https://github.com/postcss/postcss) from 8.5.6 to 8.5.15. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.15</h2> <ul> <li>Fixed declaration parsing performance (by <a href="https://github.com/homanp"><code>@homanp</code></a>).</li> </ul> <h2>8.5.14</h2> <ul> <li>Fixed custom syntax regression (by <a href="https://github.com/43081j"><code>@43081j</code></a>).</li> </ul> <h2>8.5.13</h2> <ul> <li>Fixed <code>postcss-scss</code> commend regression.</li> </ul> <h2>8.5.12</h2> <ul> <li>Fixed reading any file via user-generated CSS.</li> <li>Added <code>opts.unsafeMap</code> to disable checks.</li> </ul> <h2>8.5.11</h2> <ul> <li>Fixed nested brackets parsing performance (by <a href="https://github.com/offset"><code>@offset</code></a>).</li> </ul> <h2>8.5.10</h2> <ul> <li>Fixed XSS via unescaped <code></style></code> in non-bundler cases (by <a href="https://github.com/TharVid"><code>@TharVid</code></a>).</li> </ul> <h2>8.5.9</h2> <ul> <li>Speed up source map encoding paring in case of the error.</li> </ul> <h2>8.5.8</h2> <ul> <li>Fixed <code>Processor#version</code>.</li> </ul> <h2>8.5.7</h2> <ul> <li>Improved source map annotation cleaning performance (by CodeAnt AI).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.15</h2> <ul> <li>Fixed declaration parsing performance (by <a href="https://github.com/homanp"><code>@homanp</code></a>).</li> </ul> <h2>8.5.14</h2> <ul> <li>Fixed custom syntax regression (by <a href="https://github.com/43081j"><code>@43081j</code></a>).</li> </ul> <h2>8.5.13</h2> <ul> <li>Fixed <code>postcss-scss</code> commend regression.</li> </ul> <h2>8.5.12</h2> <ul> <li>Fixed reading any file via user-generated CSS.</li> <li>Added <code>opts.unsafeMap</code> to disable checks.</li> </ul> <h2>8.5.11</h2> <ul> <li>Fixed nested brackets parsing performance (by <a href="https://github.com/offset"><code>@offset</code></a>).</li> </ul> <h2>8.5.10</h2> <ul> <li>Fixed XSS via unescaped <code></style></code> in non-bundler cases (by <a href="https://github.com/TharVid"><code>@TharVid</code></a>).</li> </ul> <h2>8.5.9</h2> <ul> <li>Speed up source map encoding paring in case of the error.</li> </ul> <h2>8.5.8</h2> <ul> <li>Fixed <code>Processor#version</code>.</li> </ul> <h2>8.5.7</h2> <ul> <li>Improved source map annotation cleaning performance (by CodeAnt AI).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss/commit/eae46db765d752cf8f40c4fa2b0b85030079c43d"><code>eae46db</code></a> Release 8.5.15 version</li> <li><a href="https://github.com/postcss/postcss/commit/79508ffa59e42c02056aca61b88bc393c8b516c4"><code>79508ff</code></a> Update CI actions</li> <li><a href="https://github.com/postcss/postcss/commit/b128e2131288a411c6e28071d0929542c49e74eb"><code>b128e21</code></a> Speed up declaration parsing by avoiding creating new array on each token</li> <li><a href="https://github.com/postcss/postcss/commit/9825dca02c33cf610e2a842be767468b67fbecf9"><code>9825dca</code></a> Fix code format</li> <li><a href="https://github.com/postcss/postcss/commit/55789c865281e2be194fa5b4e41dd046be3a2307"><code>55789c8</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/84fbbe9009cb3cc3bbb4cc3a9b65d468f4844d95"><code>84fbbe9</code></a> Install older pnpm action for old Node.js</li> <li><a href="https://github.com/postcss/postcss/commit/9f860bd78ec1dbc4f0ae72d693f03f956baa38cb"><code>9f860bd</code></a> Revert pnpm action for old Node.js</li> <li><a href="https://github.com/postcss/postcss/commit/08771986d47359545f502e009763e223b66bfcf6"><code>0877198</code></a> Update CI actions</li> <li><a href="https://github.com/postcss/postcss/commit/b2d1a335cea818f8b27e5cfb90147648afe3e582"><code>b2d1a33</code></a> Fix linter warnings</li> <li><a href="https://github.com/postcss/postcss/commit/0700dac92283bc259977dff2743ca74a00f58267"><code>0700dac</code></a> Merge pull request <a href="https://redirect.github.com/postcss/postcss/issues/2088">#2088</a> from rootvector2/add-oss-fuzz-harness</li> <li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/8.5.6...8.5.15">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/react-native-macos/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Saad Najmi <sanajmi@microsoft.com>
Bumps [@tootallnate/once](https://github.com/TooTallNate/once) from 2.0.0 to 2.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/TooTallNate/once/releases">@tootallnate/once's releases</a>.</em></p> <blockquote> <h2>v2.0.1</h2> <h3>Patch Changes</h3> <ul> <li>a1e5e2d: Fix promise hang when AbortSignal is aborted</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/TooTallNate/once/blob/v2.0.1/CHANGELOG.md">@tootallnate/once's changelog</a>.</em></p> <blockquote> <h2>2.0.1</h2> <h3>Patch Changes</h3> <ul> <li>a1e5e2d: Fix promise hang when AbortSignal is aborted</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/TooTallNate/once/commit/bcbb21d387e5fb2d0bf8ec2fd8d0ac97d4553241"><code>bcbb21d</code></a> ci: fix OIDC publishing — Node 24, npm latest, provenance</li> <li><a href="https://github.com/TooTallNate/once/commit/dc24387be8e3405f1e7c911caf76c87b72a0e145"><code>dc24387</code></a> Version Packages (2.x) (<a href="https://redirect.github.com/TooTallNate/once/issues/12">#12</a>)</li> <li><a href="https://github.com/TooTallNate/once/commit/b8a6f80afcfd2482b4bdb1e29d784340a05e0ce3"><code>b8a6f80</code></a> CI: test all Node versions on Linux only</li> <li><a href="https://github.com/TooTallNate/once/commit/dabcc0fb6202663cd83994f0a21ea1c710395327"><code>dabcc0f</code></a> ci: drop EOL Node.js 14.x/16.x, add 22.x</li> <li><a href="https://github.com/TooTallNate/once/commit/b464efcf4238d92590245b4d211d2fc05a94d28a"><code>b464efc</code></a> Update CI: modern Node versions, fix macOS ARM64 compat</li> <li><a href="https://github.com/TooTallNate/once/commit/a1e5e2d784bcd1c65e49fac1524c6c94fe81f871"><code>a1e5e2d</code></a> Fix promise hang when AbortSignal is aborted</li> <li>See full diff in <a href="https://github.com/TooTallNate/once/compare/2.0.0...v2.0.1">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@tootallnate/once</code> since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/react-native-macos/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Saad Najmi <sanajmi@microsoft.com>
## Summary: Use `util.styleText` instead of manually detecting TTY mode and ANSI codes ## Test Plan: n/a
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.0 to 3.1.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastify/fast-uri/releases">fast-uri's releases</a>.</em></p> <blockquote> <h2>v3.1.2</h2> <h2>⚠️ Security Release</h2> <ul> <li>Fix for <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc">https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc</a></li> </ul> <h2>What's Changed</h2> <ul> <li>Handle malformed fragment decoding as a parse error by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/171">fastify/fast-uri#171</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.1...v3.1.2">https://github.com/fastify/fast-uri/compare/v3.1.1...v3.1.2</a></p> <h2>v3.1.1</h2> <h2>⚠️ Security Release</h2> <ul> <li>Fix for <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6">https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6</a></li> </ul> <h2>What's Changed</h2> <ul> <li>build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/148">fastify/fast-uri#148</a></li> <li>build(deps): bump actions/checkout from 4 to 5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/149">fastify/fast-uri#149</a></li> <li>chore(.npmrc): ignore scripts by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/150">fastify/fast-uri#150</a></li> <li>build(deps-dev): remove <code>@fastify/pre-commit</code> by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/151">fastify/fast-uri#151</a></li> <li>build(deps): bump actions/setup-node from 4 to 5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/152">fastify/fast-uri#152</a></li> <li>ci(ci): add concurrency config by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/153">fastify/fast-uri#153</a></li> <li>build(deps): bump actions/setup-node from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/154">fastify/fast-uri#154</a></li> <li>build(deps): bump actions/checkout from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/156">fastify/fast-uri#156</a></li> <li>chore(license): standardise license notice by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/159">fastify/fast-uri#159</a></li> <li>style: remove trailing whitespace by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/161">fastify/fast-uri#161</a></li> <li>ci: remove unused github files by <a href="https://github.com/Tony133"><code>@Tony133</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/162">fastify/fast-uri#162</a></li> <li>chore: update readme by <a href="https://github.com/Tony133"><code>@Tony133</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/164">fastify/fast-uri#164</a></li> <li>build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-manager.yml from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/165">fastify/fast-uri#165</a></li> <li>build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/166">fastify/fast-uri#166</a></li> <li>build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/167">fastify/fast-uri#167</a></li> <li>ci: add lock-threads workflow by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/169">fastify/fast-uri#169</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Tony133"><code>@Tony133</code></a> made their first contribution in <a href="https://redirect.github.com/fastify/fast-uri/pull/162">fastify/fast-uri#162</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.1">https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fastify/fast-uri/commit/919dd8ea7689fcc220d0d9b71307f5095e723ef9"><code>919dd8e</code></a> Bumped v3.1.2</li> <li><a href="https://github.com/fastify/fast-uri/commit/c65ba573714af6b8e19e481d9444c27bc4355d07"><code>c65ba57</code></a> fixup: linting</li> <li><a href="https://github.com/fastify/fast-uri/commit/6c86c17c3d76fb93aa3700ec6c0fa00faeb97293"><code>6c86c17</code></a> Merge commit from fork</li> <li><a href="https://github.com/fastify/fast-uri/commit/a95158ad308df4d92bbde4eba699ce5165e9f796"><code>a95158a</code></a> Handle malformed fragment decoding without throwing (<a href="https://redirect.github.com/fastify/fast-uri/issues/171">#171</a>)</li> <li><a href="https://github.com/fastify/fast-uri/commit/cea547c91c6aae610041b17b75792ca4aa035a6d"><code>cea547c</code></a> Bumped v3.1.1</li> <li><a href="https://github.com/fastify/fast-uri/commit/876ce79b662c3e5015e4e7dffe6f37752ad34f35"><code>876ce79</code></a> Merge commit from fork</li> <li><a href="https://github.com/fastify/fast-uri/commit/dcdf690b71a7bb3a19887ada65a9ab160d83bcc0"><code>dcdf690</code></a> ci: add lock-threads workflow (<a href="https://redirect.github.com/fastify/fast-uri/issues/169">#169</a>)</li> <li><a href="https://github.com/fastify/fast-uri/commit/c860e6589b1ac346f66e114b4eadb9613768108c"><code>c860e65</code></a> build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (<a href="https://redirect.github.com/fastify/fast-uri/issues/167">#167</a>)</li> <li><a href="https://github.com/fastify/fast-uri/commit/9b4c6dc82fde0ca44e674403ece9185d85bb6d5f"><code>9b4c6dc</code></a> build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (<a href="https://redirect.github.com/fastify/fast-uri/issues/166">#166</a>)</li> <li><a href="https://github.com/fastify/fast-uri/commit/85d09a9f7aa76b32c2bb005a90a71e144c361d24"><code>85d09a9</code></a> build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...</li> <li>Additional commits viewable in <a href="https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/react-native-macos/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…1 to 7.29.7 in /docsite (microsoft#2978) Bumps [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) from 7.27.1 to 7.29.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/babel/babel/releases">@babel/plugin-transform-modules-systemjs's releases</a>.</em></p> <blockquote> <h2>v7.29.7 (2026-05-25)</h2> <p>Re-release all packages with npm provenance attestations</p> <h2>v7.29.6 (2026-05-25)</h2> <h4>:bug: Bug Fix</h4> <ul> <li><code>babel-generator</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/18014">#18014</a> Catchup source map position in preserveFormat (<a href="https://github.com/nicolo-ribaudo"><code>@nicolo-ribaudo</code></a>)</li> </ul> </li> <li><code>babel-core</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/18001">#18001</a> [7.x packport]Improve input source map handling (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> <li><code>babel-core</code>, <code>babel-generator</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17998">#17998</a> Preserve original identifier names from input sourcemaps (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs/issues/17992">#17992</a>) (<a href="https://github.com/Andarist"><code>@Andarist</code></a>)</li> </ul> </li> </ul> <h4>Committers: 3</h4> <ul> <li>Huáng Jùnliàng (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> <li>Mateusz Burzyński (<a href="https://github.com/Andarist"><code>@Andarist</code></a>)</li> <li>Nicolò Ribaudo (<a href="https://github.com/nicolo-ribaudo"><code>@nicolo-ribaudo</code></a>)</li> </ul> <h2>v7.29.5 (2026-05-05)</h2> <h4>:house: Internal</h4> <ul> <li><code>babel-preset-env</code> <ul> <li>Update <code>@babel/*</code> dependencies</li> </ul> </li> </ul> <h2>v7.29.4 (2026-05-05)</h2> <h4>:bug: Bug Fix</h4> <ul> <li><code>babel-plugin-transform-modules-systemjs</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17974">#17974</a> [7.x backport]fix(systemjs): improve module string name support (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> </ul> <h4>Committers: 1</h4> <ul> <li>Huáng Jùnliàng (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> <h2>v7.29.3 (2026-04-30)</h2> <h4>:eyeglasses: Spec Compliance</h4> <ul> <li><code>babel-parser</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17923">#17923</a> Support flow extends bound (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> </ul> <h4>:bug: Bug Fix</h4> <ul> <li><code>babel-helper-create-class-features-plugin</code>, <code>babel-plugin-proposal-decorators</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17931">#17931</a> fix(decorators): replace super within all removed static elements (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> <li><code>babel-register</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17915">#17915</a> Fix thread synchronization issues in <code>@babel/register</code> (<a href="https://github.com/liuxingbaoyu"><code>@liuxingbaoyu</code></a>)</li> </ul> </li> <li><code>babel-compat-data</code>, <code>babel-plugin-bugfix-safari-rest-destructuring-rhs-array</code>, <code>babel-preset-env</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17788">#17788</a> Add bugfix plugin for Safari array rest destructuring bug (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> </ul> <h4>:nail_care: Polish</h4> <ul> <li><code>babel-parser</code></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/babel/babel/commit/4fba7541180bf5f58256d8e358b544e3831ad090"><code>4fba754</code></a> v7.29.7</li> <li><a href="https://github.com/babel/babel/commit/a458f66074b97d54773db8159af673d23b26079b"><code>a458f66</code></a> v7.29.4</li> <li><a href="https://github.com/babel/babel/commit/32ebd5aaf2526ddd176fd6a3d1e3dc594abdc8d9"><code>32ebd5a</code></a> [7.x backport]fix(systemjs): improve module string name support (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs/issues/17974">#17974</a>)</li> <li><a href="https://github.com/babel/babel/commit/aa8394e454337d118ac3d40bfa3ee1a3cb3f3ed2"><code>aa8394e</code></a> v7.29.0</li> <li><a href="https://github.com/babel/babel/commit/0053db620c05acf0036f593b5aaf4e372daa79d0"><code>0053db6</code></a> Update polyfill packages (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs/issues/17727">#17727</a>)</li> <li><a href="https://github.com/babel/babel/commit/61647ae2397c82c3c71f077b5ab109106a5cac0f"><code>61647ae</code></a> v7.28.5</li> <li><a href="https://github.com/babel/babel/commit/a177d551adba99773f4ff00ea9bf46550def6132"><code>a177d55</code></a> [Babel 8] Use <code>t.traverseFast</code> to replace some <code>path.traverse</code> (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs/issues/17518">#17518</a>)</li> <li>See full diff in <a href="https://github.com/babel/babel/commits/v7.29.7/packages/babel-plugin-transform-modules-systemjs">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@babel/plugin-transform-modules-systemjs</code> since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/react-native-macos/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#2982) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.0.6 to 3.1.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastify/fast-uri/releases">fast-uri's releases</a>.</em></p> <blockquote> <h2>v3.1.2</h2> <h2>⚠️ Security Release</h2> <ul> <li>Fix for <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc">https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc</a></li> </ul> <h2>What's Changed</h2> <ul> <li>Handle malformed fragment decoding as a parse error by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/171">fastify/fast-uri#171</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.1...v3.1.2">https://github.com/fastify/fast-uri/compare/v3.1.1...v3.1.2</a></p> <h2>v3.1.1</h2> <h2>⚠️ Security Release</h2> <ul> <li>Fix for <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6">https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6</a></li> </ul> <h2>What's Changed</h2> <ul> <li>build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/148">fastify/fast-uri#148</a></li> <li>build(deps): bump actions/checkout from 4 to 5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/149">fastify/fast-uri#149</a></li> <li>chore(.npmrc): ignore scripts by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/150">fastify/fast-uri#150</a></li> <li>build(deps-dev): remove <code>@fastify/pre-commit</code> by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/151">fastify/fast-uri#151</a></li> <li>build(deps): bump actions/setup-node from 4 to 5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/152">fastify/fast-uri#152</a></li> <li>ci(ci): add concurrency config by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/153">fastify/fast-uri#153</a></li> <li>build(deps): bump actions/setup-node from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/154">fastify/fast-uri#154</a></li> <li>build(deps): bump actions/checkout from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/156">fastify/fast-uri#156</a></li> <li>chore(license): standardise license notice by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/159">fastify/fast-uri#159</a></li> <li>style: remove trailing whitespace by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/161">fastify/fast-uri#161</a></li> <li>ci: remove unused github files by <a href="https://github.com/Tony133"><code>@Tony133</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/162">fastify/fast-uri#162</a></li> <li>chore: update readme by <a href="https://github.com/Tony133"><code>@Tony133</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/164">fastify/fast-uri#164</a></li> <li>build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-manager.yml from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/165">fastify/fast-uri#165</a></li> <li>build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/166">fastify/fast-uri#166</a></li> <li>build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/167">fastify/fast-uri#167</a></li> <li>ci: add lock-threads workflow by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/169">fastify/fast-uri#169</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Tony133"><code>@Tony133</code></a> made their first contribution in <a href="https://redirect.github.com/fastify/fast-uri/pull/162">fastify/fast-uri#162</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.1">https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.1</a></p> <h2>v3.1.0</h2> <h2>What's Changed</h2> <ul> <li>ci: remove master branch support by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/126">fastify/fast-uri#126</a></li> <li>chore(test) remove .gitkeep by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/128">fastify/fast-uri#128</a></li> <li>ci(ci): set job permissions by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/129">fastify/fast-uri#129</a></li> <li>ci: set permissions at workflow level by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/131">fastify/fast-uri#131</a></li> <li>ci: set workflow permissions to read-only by default by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/132">fastify/fast-uri#132</a></li> <li>ci(ci): restore job level permissions by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/133">fastify/fast-uri#133</a></li> <li>build(deps-dev): bump tsd from 0.31.2 to 0.32.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/134">fastify/fast-uri#134</a></li> <li>ci(ci): pin actions to commit-hash by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/135">fastify/fast-uri#135</a></li> <li>ci: add node 24 to test matrix by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/136">fastify/fast-uri#136</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fastify/fast-uri/commit/919dd8ea7689fcc220d0d9b71307f5095e723ef9"><code>919dd8e</code></a> Bumped v3.1.2</li> <li><a href="https://github.com/fastify/fast-uri/commit/c65ba573714af6b8e19e481d9444c27bc4355d07"><code>c65ba57</code></a> fixup: linting</li> <li><a href="https://github.com/fastify/fast-uri/commit/6c86c17c3d76fb93aa3700ec6c0fa00faeb97293"><code>6c86c17</code></a> Merge commit from fork</li> <li><a href="https://github.com/fastify/fast-uri/commit/a95158ad308df4d92bbde4eba699ce5165e9f796"><code>a95158a</code></a> Handle malformed fragment decoding without throwing (<a href="https://redirect.github.com/fastify/fast-uri/issues/171">#171</a>)</li> <li><a href="https://github.com/fastify/fast-uri/commit/cea547c91c6aae610041b17b75792ca4aa035a6d"><code>cea547c</code></a> Bumped v3.1.1</li> <li><a href="https://github.com/fastify/fast-uri/commit/876ce79b662c3e5015e4e7dffe6f37752ad34f35"><code>876ce79</code></a> Merge commit from fork</li> <li><a href="https://github.com/fastify/fast-uri/commit/dcdf690b71a7bb3a19887ada65a9ab160d83bcc0"><code>dcdf690</code></a> ci: add lock-threads workflow (<a href="https://redirect.github.com/fastify/fast-uri/issues/169">#169</a>)</li> <li><a href="https://github.com/fastify/fast-uri/commit/c860e6589b1ac346f66e114b4eadb9613768108c"><code>c860e65</code></a> build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (<a href="https://redirect.github.com/fastify/fast-uri/issues/167">#167</a>)</li> <li><a href="https://github.com/fastify/fast-uri/commit/9b4c6dc82fde0ca44e674403ece9185d85bb6d5f"><code>9b4c6dc</code></a> build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (<a href="https://redirect.github.com/fastify/fast-uri/issues/166">#166</a>)</li> <li><a href="https://github.com/fastify/fast-uri/commit/85d09a9f7aa76b32c2bb005a90a71e144c361d24"><code>85d09a9</code></a> build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...</li> <li>Additional commits viewable in <a href="https://github.com/fastify/fast-uri/compare/v3.0.6...v3.1.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/react-native-macos/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…2980) Co-authored-by: microsoft-github-policy-service[bot] <77245923+microsoft-github-policy-service[bot]@users.noreply.github.com> Co-authored-by: Saad Najmi <sanajmi@microsoft.com>
…icrosoft#2973) ## Summary: In theory, `@react-native-community/cli` should be an optional dependency, but currently the `runMacOS` commands import requires `@react-native-community/cli` directly, causing Expo CLI users to also have to install `@react-native-community/cli` This PR guards the `require` the same way as the platform packages, and only attaches the commands when the import succeeds. The runtime behavior for projects that do install the CLI is unchanged. ## Test Plan: - In a project that does not depend on `@react-native-community/cli` (e.g. an Expo app using `expo-modules-autolinking`), run `pod install` and confirm `use_native_modules!` no longer throws when loading `react-native.config.js`. - In a project that depends on `@react-native-community/cli`, confirm `npx react-native run-macos` and the other macOS commands still register and work as before. - With `DEBUG=*` set, confirm the new warning (`./local-cli/runMacOS/runMacOS not found, the react-native.config.js may be unusable.`) is emitted only when the require fails, matching the existing warnings for the other platform packages.
…2984) Co-authored-by: microsoft-github-policy-service[bot] <77245923+microsoft-github-policy-service[bot]@users.noreply.github.com>
Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.8.12 to 0.8.13. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/xmldom/xmldom/releases">@xmldom/xmldom's releases</a>.</em></p> <blockquote> <h2>0.8.13</h2> <p><a href="https://github.com/xmldom/xmldom/compare/0.8.12...0.8.13">Commits</a></p> <h3>Fixed</h3> <ul> <li>Security: <code>XMLSerializer.serializeToString()</code> (and <code>Node.toString()</code>, <code>NodeList.toString()</code>) now accept a <code>requireWellFormed</code> option (fourth argument, after <code>isHtml</code> and <code>nodeFilter</code>). When <code>{ requireWellFormed: true }</code> is passed, the serializer throws <code>InvalidStateError</code> for injection-prone node content, preventing XML injection via attacker-controlled node data. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8"><code>GHSA-j759-j44w-7fr8</code></a> <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx"><code>GHSA-x6wf-f3px-wcqx</code></a> <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h"><code>GHSA-f6ww-3ggp-fr8h</code></a> <ul> <li>Comment: throws when <code>data</code> contains <code>--></code></li> <li>ProcessingInstruction: throws when <code>data</code> contains <code>?></code></li> <li>DocumentType: throws when <code>publicId</code> fails <code>PubidLiteral</code>, <code>systemId</code> fails <code>SystemLiteral</code>, or <code>internalSubset</code> contains <code>]></code></li> </ul> </li> <li>Security: DOM traversal operations (<code>XMLSerializer.serializeToString()</code>, <code>Node.prototype.normalize()</code>, <code>Node.prototype.cloneNode(true)</code>, <code>Document.prototype.importNode(node, true)</code>, <code>node.textContent</code> getter, <code>getElementsByTagName()</code> / <code>getElementsByTagNameNS()</code> / <code>getElementsByClassName()</code> / <code>getElementById()</code>) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable <code>RangeError</code>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw"><code>GHSA-2v35-w6hq-6mfw</code></a></li> </ul> <p>Thank you, <a href="https://github.com/Jvr2022"><code>@Jvr2022</code></a>, <a href="https://github.com/praveen-kv"><code>@praveen-kv</code></a>, <a href="https://github.com/TharVid"><code>@TharVid</code></a>, <a href="https://github.com/decsecre583"><code>@decsecre583</code></a>, <a href="https://github.com/tlsbollei"><code>@tlsbollei</code></a>, <a href="https://github.com/KarimTantawey"><code>@KarimTantawey</code></a>, for your contributions</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md">@xmldom/xmldom's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/xmldom/xmldom/compare/0.8.12...0.8.13">0.8.13</a></h2> <h3>Fixed</h3> <ul> <li>Security: <code>XMLSerializer.serializeToString()</code> (and <code>Node.toString()</code>, <code>NodeList.toString()</code>) now accept a <code>requireWellFormed</code> option (fourth argument, after <code>isHtml</code> and <code>nodeFilter</code>). When <code>{ requireWellFormed: true }</code> is passed, the serializer throws <code>InvalidStateError</code> for injection-prone node content, preventing XML injection via attacker-controlled node data. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8"><code>GHSA-j759-j44w-7fr8</code></a> <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx"><code>GHSA-x6wf-f3px-wcqx</code></a> <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h"><code>GHSA-f6ww-3ggp-fr8h</code></a> <ul> <li>Comment: throws when <code>data</code> contains <code>--></code></li> <li>ProcessingInstruction: throws when <code>data</code> contains <code>?></code></li> <li>DocumentType: throws when <code>publicId</code> fails <code>PubidLiteral</code>, <code>systemId</code> fails <code>SystemLiteral</code>, or <code>internalSubset</code> contains <code>]></code></li> </ul> </li> <li>Security: DOM traversal operations (<code>XMLSerializer.serializeToString()</code>, <code>Node.prototype.normalize()</code>, <code>Node.prototype.cloneNode(true)</code>, <code>Document.prototype.importNode(node, true)</code>, <code>node.textContent</code> getter, <code>getElementsByTagName()</code> / <code>getElementsByTagNameNS()</code> / <code>getElementsByClassName()</code> / <code>getElementById()</code>) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable <code>RangeError</code>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw"><code>GHSA-2v35-w6hq-6mfw</code></a></li> </ul> <p>Thank you, <a href="https://github.com/Jvr2022"><code>@Jvr2022</code></a>, <a href="https://github.com/praveen-kv"><code>@praveen-kv</code></a>, <a href="https://github.com/TharVid"><code>@TharVid</code></a>, <a href="https://github.com/decsecre583"><code>@decsecre583</code></a>, <a href="https://github.com/tlsbollei"><code>@tlsbollei</code></a>, <a href="https://github.com/KarimTantawey"><code>@KarimTantawey</code></a>, for your contributions</p> <h2><a href="https://github.com/xmldom/xmldom/compare/0.9.8...0.9.9">0.9.9</a></h2> <h3>Added</h3> <ul> <li>implement <code>ParentNode.children</code> getter <a href="https://redirect.github.com/xmldom/xmldom/pull/960"><code>[#960](https://github.com/xmldom/xmldom/issues/960)</code></a> / <a href="https://redirect.github.com/xmldom/xmldom/issues/410"><code>[#410](https://github.com/xmldom/xmldom/issues/410)</code></a></li> </ul> <h3>Fixed</h3> <ul> <li>Security: <code>createCDATASection</code> now throws <code>InvalidCharacterError</code> when <code>data</code> contains <code>"]]>"</code>, as required by the <a href="https://dom.spec.whatwg.org/#dom-document-createcdatasection">WHATWG DOM spec</a>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li> <li>Security: <code>XMLSerializer</code> now splits CDATASection nodes whose data contains <code>"]]>"</code> into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (<code>appendData</code>, <code>replaceData</code>, <code>.data =</code>, <code>.textContent =</code>). <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li> <li>correctly traverse ancestor chain in <code>Node.contains</code> <a href="https://redirect.github.com/xmldom/xmldom/pull/931"><code>[#931](https://github.com/xmldom/xmldom/issues/931)</code></a></li> </ul> <p>Code that passes a string containing <code>"]]>"</code> to <code>createCDATASection</code> and relied on the previously unsafe behavior will now receive <code>InvalidCharacterError</code>. Use a mutation method such as <code>appendData</code> if you intentionally need <code>"]]>"</code> in a CDATASection node's data.</p> <h3>Chore</h3> <ul> <li>updated dependencies</li> </ul> <p>Thank you, <a href="https://github.com/stevenobiajulu"><code>@stevenobiajulu</code></a>, <a href="https://github.com/yoshi389111"><code>@yoshi389111</code></a>, <a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>, for your contributions</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/xmldom/xmldom/commit/e5c14802592685bb872c042c54c3f73758875c85"><code>e5c1480</code></a> 0.8.13</li> <li><a href="https://github.com/xmldom/xmldom/commit/9611e20d75f059dc377f806a8f7ee7d1eaeaeb7c"><code>9611e20</code></a> style: drop unused import in test file</li> <li><a href="https://github.com/xmldom/xmldom/commit/dc4dff3d1d0b5a6b97c52fcc1823a735b8821e62"><code>dc4dff3</code></a> docs: add 0.8.13 changelog entry</li> <li><a href="https://github.com/xmldom/xmldom/commit/842fa38deedd2d9a9c90d0ad54aa1be75d2a41bc"><code>842fa38</code></a> fix: prevent stack overflow in normalize (GHSA-2v35-w6hq-6mfw)</li> <li><a href="https://github.com/xmldom/xmldom/commit/aeff69f5a32e8c1bd540683da9e10718f84f595c"><code>aeff69f</code></a> test: add normalize behavioral coverage to node.test.js</li> <li><a href="https://github.com/xmldom/xmldom/commit/cbdb0d7db8ae70760bd4cc181cb8f30bb0cd9d88"><code>cbdb0d7</code></a> fix: make walkDOM iterative to prevent stack overflow (GHSA-2v35-w6hq-6mfw)</li> <li><a href="https://github.com/xmldom/xmldom/commit/0b543d31794dc198c86a0358574cb5dec29674c5"><code>0b543d3</code></a> test: assert namespace declarations are isolated between siblings in serializ...</li> <li><a href="https://github.com/xmldom/xmldom/commit/c007c51909587990c962cf3d5c2acadf4c897b87"><code>c007c51</code></a> refactor: migrate serializeToString to walkDOM</li> <li><a href="https://github.com/xmldom/xmldom/commit/2bb3899074820089d9e76ce28a5edfdacf425025"><code>2bb3899</code></a> test: add serializeToString coverage for uncovered branches</li> <li><a href="https://github.com/xmldom/xmldom/commit/e69f38d0a58731152d300e8c8eb29506f5f488fe"><code>e69f38d</code></a> refactor: migrate importNode to walkDOM</li> <li>Additional commits viewable in <a href="https://github.com/xmldom/xmldom/compare/0.8.12...0.8.13">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~karfau">karfau</a>, a new releaser for <code>@xmldom/xmldom</code> since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/react-native-macos/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…9 to 7.29.7 (microsoft#2985) Bumps [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) from 7.25.9 to 7.29.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/babel/babel/releases">@babel/plugin-transform-modules-systemjs's releases</a>.</em></p> <blockquote> <h2>v7.29.7 (2026-05-25)</h2> <p>Re-release all packages with npm provenance attestations</p> <h2>v7.29.6 (2026-05-25)</h2> <h4>:bug: Bug Fix</h4> <ul> <li><code>babel-generator</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/18014">#18014</a> Catchup source map position in preserveFormat (<a href="https://github.com/nicolo-ribaudo"><code>@nicolo-ribaudo</code></a>)</li> </ul> </li> <li><code>babel-core</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/18001">#18001</a> [7.x packport]Improve input source map handling (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> <li><code>babel-core</code>, <code>babel-generator</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17998">#17998</a> Preserve original identifier names from input sourcemaps (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs/issues/17992">#17992</a>) (<a href="https://github.com/Andarist"><code>@Andarist</code></a>)</li> </ul> </li> </ul> <h4>Committers: 3</h4> <ul> <li>Huáng Jùnliàng (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> <li>Mateusz Burzyński (<a href="https://github.com/Andarist"><code>@Andarist</code></a>)</li> <li>Nicolò Ribaudo (<a href="https://github.com/nicolo-ribaudo"><code>@nicolo-ribaudo</code></a>)</li> </ul> <h2>v7.29.5 (2026-05-05)</h2> <h4>:house: Internal</h4> <ul> <li><code>babel-preset-env</code> <ul> <li>Update <code>@babel/*</code> dependencies</li> </ul> </li> </ul> <h2>v7.29.4 (2026-05-05)</h2> <h4>:bug: Bug Fix</h4> <ul> <li><code>babel-plugin-transform-modules-systemjs</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17974">#17974</a> [7.x backport]fix(systemjs): improve module string name support (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> </ul> <h4>Committers: 1</h4> <ul> <li>Huáng Jùnliàng (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> <h2>v7.29.3 (2026-04-30)</h2> <h4>:eyeglasses: Spec Compliance</h4> <ul> <li><code>babel-parser</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17923">#17923</a> Support flow extends bound (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> </ul> <h4>:bug: Bug Fix</h4> <ul> <li><code>babel-helper-create-class-features-plugin</code>, <code>babel-plugin-proposal-decorators</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17931">#17931</a> fix(decorators): replace super within all removed static elements (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> <li><code>babel-register</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17915">#17915</a> Fix thread synchronization issues in <code>@babel/register</code> (<a href="https://github.com/liuxingbaoyu"><code>@liuxingbaoyu</code></a>)</li> </ul> </li> <li><code>babel-compat-data</code>, <code>babel-plugin-bugfix-safari-rest-destructuring-rhs-array</code>, <code>babel-preset-env</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17788">#17788</a> Add bugfix plugin for Safari array rest destructuring bug (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> </ul> <h4>:nail_care: Polish</h4> <ul> <li><code>babel-parser</code></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/babel/babel/commit/4fba7541180bf5f58256d8e358b544e3831ad090"><code>4fba754</code></a> v7.29.7</li> <li><a href="https://github.com/babel/babel/commit/a458f66074b97d54773db8159af673d23b26079b"><code>a458f66</code></a> v7.29.4</li> <li><a href="https://github.com/babel/babel/commit/32ebd5aaf2526ddd176fd6a3d1e3dc594abdc8d9"><code>32ebd5a</code></a> [7.x backport]fix(systemjs): improve module string name support (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs/issues/17974">#17974</a>)</li> <li><a href="https://github.com/babel/babel/commit/aa8394e454337d118ac3d40bfa3ee1a3cb3f3ed2"><code>aa8394e</code></a> v7.29.0</li> <li><a href="https://github.com/babel/babel/commit/0053db620c05acf0036f593b5aaf4e372daa79d0"><code>0053db6</code></a> Update polyfill packages (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs/issues/17727">#17727</a>)</li> <li><a href="https://github.com/babel/babel/commit/61647ae2397c82c3c71f077b5ab109106a5cac0f"><code>61647ae</code></a> v7.28.5</li> <li><a href="https://github.com/babel/babel/commit/a177d551adba99773f4ff00ea9bf46550def6132"><code>a177d55</code></a> [Babel 8] Use <code>t.traverseFast</code> to replace some <code>path.traverse</code> (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs/issues/17518">#17518</a>)</li> <li><a href="https://github.com/babel/babel/commit/eebd3a06021c13d335b5b0bd79734df3abbea678"><code>eebd3a0</code></a> v7.27.1</li> <li><a href="https://github.com/babel/babel/commit/317e332e650bc04907bc787ab79f930288a3e71e"><code>317e332</code></a> Enforce node protocol import (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs/issues/17207">#17207</a>)</li> <li><a href="https://github.com/babel/babel/commit/fdc0fb59e119ee0b38bced63867a344a5b4bc2f3"><code>fdc0fb5</code></a> [Babel 8] Bump nodejs requirements to <code>^20.19.0 || >= 22.12.0</code> (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs/issues/17204">#17204</a>)</li> <li>Additional commits viewable in <a href="https://github.com/babel/babel/commits/v7.29.7/packages/babel-plugin-transform-modules-systemjs">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@babel/plugin-transform-modules-systemjs</code> since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/react-native-macos/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary Cherry-pick of react@faeef2b (react#56099). fmt 11.0.2 enables `consteval` on Apple clang ≥ 14 (which includes Xcode 26.4), but Xcode 26.4's stricter clang rejects consteval expressions in fmt's format-inl.h. fmt 12.1.0 fixes this. Changes: - `packages/react-native/third-party-podspecs/fmt.podspec`: 11.0.2 → 12.1.0 - `packages/react-native/third-party-podspecs/RCT-Folly.podspec": fmt dep 11.0.2 → 12.1.0 - `packages/react-native/gradle/libs.versions.toml`: 11.0.2 → 12.1.0 - `packages/rn-tester/Podfile.lock`: updated fmt version + checksum - `scripts/releases/ios-prebuild/configuration.js`: 11.0.2 → 12.1.0 ## Test Plan RNTester macOS builds successfully on Xcode 26.4. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…osoft#2995) ## Summary: The CocoaPods autolinking script hard-codes the `ios` platform key when reading the `react-native config` JSON, which assumes the upstream config provider always emits its project root and per-package config under `ios`. For proper out-of-tree platform support, autolinking should honor `--platform macos` and read `package["platforms"]["macos"]`, otherwise `config["project"]["ios"]` is `nil` and `pod install` crashes. ## Test Plan: - `pod install` in a `react-native-macos` test app driven by Expo's CLI (`expo-modules-autolinking` with `--platform macos`) completes without the `nil:NilClass` error on `config["project"]["ios"]`. - `pod install` in a `react-native-macos` test app driven by `@react-native-community/cli` (which emits `ios` keys) still resolves the same set of pods as before. - Autolinked modules that only declare `platforms.ios` in their `react-native.config.js` still appear in `Found N modules for target ...`.
…cComponents (microsoft#2969) ## Summary The `scrollview` subspec is declared in BOTH `React-Fabric.podspec` and `React-FabricComponents.podspec`, with overlapping `source_files`: - `React-Fabric.podspec` → `react/renderer/components/scrollview/**/*.{m,mm,cpp,h}` (recursive) - `React-FabricComponents.podspec` → `react/renderer/components/scrollview/*.{m,mm,cpp,h}` + `scrollview/platform/cxx/**/*` (non-recursive + platform/cxx) Both globs include the same top-level files (`ScrollViewShadowNode.cpp`, `BaseScrollViewProps.cpp`, `ScrollEvent.cpp`, etc.). After `pod install`, those source files end up in both the `React-Fabric` and `React-FabricComponents` Pods targets. ### What breaks - **Consumers that link both libraries** (e.g. via `-all_load`) hit **duplicate symbol** errors at link time. - **Consumers that deduplicate by hand** by dropping scrollview sources from one target break differently: `React-Fabric`'s `mounting/internal/CullingContext.cpp` references `ScrollViewShadowNode`, so if the dedup drops it from `React-Fabric`, link fails with `Undefined symbols: ScrollViewShadowNode`. ### Fix Comment out (rather than delete, per the [macOS diffs-with-upstream guide](https://github.com/microsoft/react-native-macos/blob/main/docsite/docs/contributing/diffs-with-upstream.md)) the `scrollview` subspec in `React-FabricComponents.podspec`, wrapped in `# [macOS` / `# macOS]` diff tags with an inline explanation. The recursive glob in `React-Fabric.podspec`'s scrollview subspec already covers everything FabricComponents was listing. ### Test plan - [x] `pod install` succeeded against this branch (`RCT_NEW_ARCH_ENABLED=0` in `packages/rn-tester/`). - [x] Generated `Pods.xcodeproj`: - `React-Fabric-macOS` target's Sources phase contains `ScrollViewShadowNode.cpp`, `BaseScrollViewProps.cpp`, `ScrollEvent.cpp`, `ScrollViewEventEmitter.cpp`, `ScrollViewState.cpp` ✓ - `React-FabricComponents-macOS` target's Sources phase does NOT contain those files ✓ - [ ] Build verification on `RNTester` (CI will do this) Discovered while integrating `react-native-macos` v0.81.6 into a monorepo that links both `libReact-Fabric-macOS.a` and `libReact-FabricComponents-macOS.a` via `-all_load`.
…microsoft#3008) ## Summary `RCTViewComponentView.prepareForRecycle` resets `allowsVibrancy`, `acceptsFirstMouse`, and `mouseDownCanMoveWindow` to their defaults on macOS. But `_props` is preserved across recycle and `updateProps:` diffs against it, so resetting the native state without also resetting `_props` desyncs the two: when a recycled view is reused by a node holding the same non-default value, the diff sees no change, skips re-applying, and the native state stays stuck at the default. Removing the resets makes macOS rely on the preserved-`_props` diff, matching the iOS path (which resets no prop-derived state here). ## Test plan Recycle `View`s carrying a non-default `mouseDownCanMoveWindow` / `acceptsFirstMouse` / `allowsVibrancy` (e.g. in a scrolling list) and confirm reused rows keep the correct native behavior instead of reverting to defaults. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ft#2948) ## Summary Replaces the Objective-C/Storyboard-based macOS init template with a modern **SwiftUI** implementation. The app delegate hosts the React Native root view inside a SwiftUI `Window` scene via `NSViewRepresentable`, so the template gets standard macOS menus, window management, and lifecycle handling for free from SwiftUI. **Net diff vs main: ~219 insertions, ~770 deletions** — most of the reduction comes from removing the 684-line `Main.storyboard` XML and the ~130-line programmatic `NSMenu` builder. ## Why SwiftUI? When replacing the Storyboard, both pure AppKit and SwiftUI were on the table: - **Pure AppKit** required hand-rolling the entire menu bar (~130 lines of `NSMenuItem` boilerplate) and manually creating an `NSWindow`. - **SwiftUI** provides standard App, Edit, View, Window, and Help menus by default through `WindowGroup`/`Window`, plus declarative window sizing via `.defaultSize(...)`. Because React Native's view is an `NSView`, embedding it in SwiftUI is a one-liner with `NSViewRepresentable` — no awkward bridging. ## Changes ### Files removed - `AppDelegate.h` / `AppDelegate.mm` — replaced by `AppDelegate.swift` - `main.m` — replaced by `@main` on the SwiftUI `App` struct (no `main.swift` needed) - `Base.lproj/Main.storyboard` (684 lines of XML) — replaced by SwiftUI ### Files added - **`AppDelegate.swift`** (59 lines) — contains: - `@main struct HelloWorldApp: App` with a `Window` scene, `.defaultSize(width: 1280, height: 720)` - `AppDelegate: NSObject, NSApplicationDelegate` wired via `@NSApplicationDelegateAdaptor`, initializing `RCTReactNativeFactory` in `init()` - `ReactNativeDelegate: RCTDefaultReactNativeFactoryDelegate` for `bundleURL()` / `sourceURL(for:)` - `ReactNativeView: NSViewRepresentable` wrapping `factory.rootViewFactory.view(withModuleName:)` ### Files modified - **`Info.plist`** — removed `NSMainStoryboardFile` key - **`project.pbxproj`** — updated file references from ObjC/storyboard to Swift; removed `main.swift` references in favor of `@main` ## Architecture alignment with upstream | Aspect | Upstream iOS | This PR (macOS) | |--------|-------------|-----------------| | Language | Swift | Swift ✅ | | App lifecycle | UIKit `UIApplicationDelegate` | **SwiftUI `App` + `NSApplicationDelegate` adaptor** | | AppDelegate base | `UIResponder, UIApplicationDelegate` | `NSObject, NSApplicationDelegate` ✅ | | Factory pattern | `RCTReactNativeFactory` + `ReactNativeDelegate` | Same ✅ | | `RCTAppDelegate` (deprecated) | Not used | Not used ✅ | | Dependency provider | `RCTAppDependencyProvider()` | Same ✅ | | `bundleURL()` / `sourceURL(for:)` | Debug→bundler, Release→jsbundle | Same ✅ | | Storyboard | None (uses `@main`) | None (uses `@main`) ✅ | | Window creation | `UIWindow(frame:)` | **SwiftUI `Window` scene** | | RN view hosting | `RCTRootView` directly | **`NSViewRepresentable` → `RCTRootView`** | | Menu bar | N/A (iOS) | **Provided by SwiftUI defaults** | | Entry point | Generated by `@main` | Generated by `@main` ✅ | ## Menu bar SwiftUI provides the standard macOS menu bar automatically with no code: - **App**: About, Settings, Services, Hide, Hide Others, Show All, Quit - **Edit**: Undo, Redo, Cut, Copy, Paste, Delete, Select All - **View**: Show/Hide Toolbar, Customize Toolbar, Enter Full Screen - **Window**: Minimize, Zoom, Close, Bring All to Front - **Help**: Standard system-managed Using `Window` (instead of `WindowGroup`) intentionally omits the "New Window" command, which is appropriate for a single-window React Native app. ## Testing - ✅ Template generator produces correct output with project name substitution - ✅ `pod install` succeeds - ✅ `AppDelegate.swift` compiles cleanly - ✅ Full build succeeds with the new architecture (`RCT_NEW_ARCH_ENABLED=1`) - ✅ App launches, Metro connects, and the JS bundle (`NewAppScreen`) renders inside the SwiftUI `Window` - ✅ Standard menus (Quit ⌘Q, Copy ⌘C, Paste ⌘V, Enter Full Screen ⌃⌘F, Minimize ⌘M, etc.) all work out of the box ## Why this is better than pure AppKit - **−122 net lines** in `AppDelegate.swift` vs the AppKit version - **No `NSMenu` boilerplate** — SwiftUI provides standard menus automatically - **No manual `NSWindow` setup** — `Window` scene handles size, title bar, lifecycle - **No `main.swift` needed** — `@main` generates the entry point - **Declarative window sizing** via `.defaultSize(width:height:)` - **Future-proof** — aligns with Apple's recommended app structure
…s handling (microsoft#2972) ## Summary: Closes microsoft#2955, with the same changes described in the issue description ## Test Plan: Broken behavior, new arch, before changes: https://github.com/user-attachments/assets/174b7f6d-2c6b-4b08-9121-bbb7d6b204f4 After changes: https://github.com/user-attachments/assets/081435d5-55c9-4559-bea8-04a3d7064406 --------- Co-authored-by: Saad Najmi <sanajmi@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ent, VirtualView) (microsoft#3015) ## Summary Supersedes microsoft#2959 (the original PR's source fork is disabled, so that branch can no longer be updated). This carries the same three macOS Fabric focus/first-responder fixes forward, with @tvinhas's original commit cherry-picked to preserve authorship credit, plus one small refinement. The three regressions were surfaced while validating the "Verify focus changes" item on microsoft#2901. ### 1. `RCTViewComponentView.blur()` was a no-op `resignFirstResponder` on `NSWindow` doesn't clear the focused subview, so `ref.blur()` from JS did nothing. Now clears the first responder via `makeFirstResponder:nil`, **guarded on `self`** so it only clears focus when this view actually holds it — matching iOS `[self resignFirstResponder]` semantics and avoiding stealing focus from an unrelated view. ### 2. Fabric `setAccessibilityFocus` was a silent no-op on macOS `synchronouslyDispatchAccessbilityEventOnUIThread:` had a `#if !TARGET_OS_OSX` guard with no `#else`, so `AccessibilityInfo.setAccessibilityFocus(reactTag)` did nothing on the Fabric path. Added the macOS branch (`makeFirstResponder:` + `NSAccessibilityFocusedUIElementChangedNotification`), mirroring the old-arch path in `RCTAccessibilityManager.mm`. ### 3. `RCTVirtualViewComponentView` keyboard-nav hooks Added `acceptsFirstResponder` and `accessibilityHitTest:` to the macOS branch so keyboard/Tab and VoiceOver navigation unhide flagged-offscreen views under the `hideOffscreenVirtualViews` optimization. Partial by design (a fully `hidden=YES` view is dropped from the responder chain — full fix needs a hide-strategy redesign, tracked as follow-up). ## Difference from microsoft#2959 - Added the `if ([[self window] firstResponder] == self)` guard on `blur()` for iOS-parity / to avoid focus-stealing. - Trimmed the verbose inline comments. ## Test plan - Builds clean: RNTester-macOS (`xcodebuild -scheme RNTester-macOS -destination 'generic/platform=macOS'`) — **BUILD SUCCEEDED**. - All three changes are macOS-gated (`#if TARGET_OS_OSX` / `#else`) and preserve existing iOS/visionOS behavior. ## Credit Original work by @tvinhas in microsoft#2959 (commit cherry-picked to retain authorship). Co-authored-by: Thiago Vinhas <thiago@vinhas.net> --------- Co-authored-by: Thiago Vinhas <thiago@vinhas.net> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
## Summary - normalize CRLF line endings when parsing `/backport` comments - prevent carriage returns from becoming part of target branch names ## Test Plan - verified `/backport 0.81-stable\r\n` parses as `0.81-stable` - parsed the updated workflow as YAML --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Fixes microsoft#1969 ## Summary Add RNTester coverage for `USE_FRAMEWORKS=dynamic` and fix the first set of build issues it exposed. - Include `folly/memory/SanitizeLeak.cpp` in RCT-Folly. The declarations were already used by Folly headers, but the implementation was not part of the pod target. - Configure the multi-platform RNTester Podfile before podspec evaluation so framework header paths include the platform suffix. - Set `SUPPORTED_PLATFORMS` on RNTester's generated pod targets. This keeps Xcode from selecting multiple platform variants of the same framework and avoids duplicate Hermes build outputs. The RNTester-specific workaround stays in `packages/rn-tester/Podfile`; this PR does not change the shared ReactCommon podspecs or CocoaPods helpers. ## RCTUIKit RCTUIKit now lives under `ReactApple/Libraries/RCTUIKit`, alongside the other Apple-specific libraries. The CocoaPods package name remains `React-RCTUIKit`, while the canonical CocoaPods/SwiftPM module is `RCTUIKit`. The canonical import is: ```objc #import <RCTUIKit/RCTUIKit.h> ``` The two existing imports used by React Native and downstream packages remain supported: ```objc #import <React/RCTUIKit.h> #import <React/RCTPlatformDisplayLink.h> ``` The latter is used by Reanimated/Worklets on macOS. Prebuild header staging exposes both the canonical and compatibility paths. ## CI RNTester now builds a static/dynamic linkage matrix for macOS, iOS, and visionOS across both architectures. Static builds remain required. Dynamic pod-install and build steps are nonblocking for now so they can act as a canary while the remaining framework issues are worked through. ## Validation - Static RNTester iOS build passes locally. - Dynamic RNTester avoids duplicate Hermes outputs and resolves RCTUIKit without missing-header, module-cycle, or non-modular-header errors. - CI passes all static RNTester jobs. - SwiftPM platform builds and XCFramework composition pass in the macOS prebuild workflow. --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…#2956) ## Summary Replaces the hardcoded `'react-native-macos'` string at `packages/react-native/react-native.config.js:188` with the `REACT_NATIVE` constant from `scripts/codegen/generate-artifacts-executor/constants.js`. The constant already reads `packageJson.name` so the resolved value is unchanged on this fork, but the indirection means future package-name moves (workspace renames, internal rebrand, etc.) don't require remembering this one site. Closes the **"Codegen package name constant"** item on the Road to 0.83 tracking issue (microsoft#2901). ## Test Plan - `pod install` in `packages/rn-tester` runs the codegen step end-to-end and resolves `npmPackageName` without errors (validated locally on 0.83-merge). - No behavior change for the current package name `react-native-macos`.
…crosoft#2963) ## Summary `packages/react-native/package.json` lists three macOS-fork podspecs in the `files` array — `React-Core.podspec`, `React-Core-prebuilt.podspec`, `React.podspec` — but **omits `React-RCTUIKit.podspec`**, which was introduced by microsoft#2847 (RCTUIKit module-ification, merged March 2026). As a result the file lives in the source tree but is excluded from the npm publish. Any downstream consumer of a published \`react-native-macos@0.83\` hits this immediately: \`\`\` [!] No podspec found for \`React-RCTUIKit\` in \`../node_modules/react-native-macos/\` \`\`\` \`pod install\` fails before reaching any actual install step. Discovered while running [react-native-test-app](https://github.com/microsoft/react-native-test-app)'s \`example-macos\` against the fork's \`0.83-merge\` via a local Verdaccio registry — the file shows up in the source tree (\`packages/react-native/React-RCTUIKit.podspec\`) but never lands in \`node_modules/react-native-macos/\` after install. Fix is a one-line addition to the \`files\` array, right next to the other root-level podspecs. Closes the consumer-install gap for any downstream user (RNTA, Epistles, anyone else) once 0.83 ships to npm. ## Test Plan - **Before:** \`npm pack\` on \`packages/react-native\` produces a tarball without \`React-RCTUIKit.podspec\`. RNTA's \`example-macos\` \`pod install\` fails with "No podspec found for React-RCTUIKit". - **After:** \`npm pack\` includes the file; \`pod install\` resolves the React-RCTUIKit pod from \`../node_modules/react-native-macos/React-RCTUIKit.podspec\` and continues. Validated locally with RNTA's \`example-macos\` building cleanly through to a \`ReactTestApp.app\` artifact. ## Related - microsoft#2847 — introduced \`React-RCTUIKit.podspec\` (and the corresponding \`React-RCTUIKit\` pod dep in \`React-Core.podspec\`), but didn't update the \`files\` array. - microsoft#2958 — wires \`React-RCTUIKit\` into \`RCTSwiftUI.podspec\`; depends on this podspec being available to consumers. - microsoft#2901 — Road to 0.83 tracking issue (unblocks downstream consumers in general).
…3-merge (microsoft#2960) ## Summary The `RNTesterPods.xcodeproj/project.pbxproj` file is **missing from `0.83-merge`** but exists on `main`. Without it, `pod install` fails immediately on `0.83-merge` with: [!] The plist file at path /.../packages/rn-tester/RNTesterPods.xcodeproj/project.pbxproj doesn't exist. Which blocks any contributor from validating any PR against `0.83-merge` via the RNTester pod-install path. ### Root cause (interaction between an ignore rule and the upstream merge) Both `main` and `0.83-merge` carry this rule in `.gitignore`: /packages/rn-tester/**/*.xcodeproj On `main`, `project.pbxproj` is tracked despite that rule — `gitignore` does not affect files already in the index, and the file was originally added before the rule existed (or via `-f`). On `0.83-merge`, the file was dropped from the tree at some point during the upstream-0.83 merge (likely via a `git rm` resolving a conflicting hunk, or via a merge driver that touched the .xcodeproj contents). Once it was out of the index, the existing ignore rule prevented anyone from `git add`ing it back through the normal path — the explicit `-f` flag is required. Verification via `gh api`: - `main` tree contains `packages/rn-tester/RNTesterPods.xcodeproj/project.pbxproj` (blob SHA `90e6c295ce0ec461333aa96af37d8b0ceebe98dc`, 120,346 bytes). - `0.83-merge` tree only contains `packages/rn-tester/RNTesterPods.xcodeproj/xcshareddata/` (the scheme files). - The xcshareddata/ scheme files on `0.83-merge` reference `RNTesterPods.xcodeproj` as their container, so the absence isn't an intentional structural change. ### Fix This PR restores the file verbatim from `main`'s blob `90e6c295…` (force-added past the ignore rule). Once in the index, future operations track it normally. The `.gitignore` rule is preserved unchanged — it correctly excludes other generated `.xcodeproj` outputs and only needed the one-time `-f` to reseat this specific file. The .pbxproj is structurally cross-compatible between `main` (RN 0.81.x content) and `0.83-merge` (RN 0.83 content) — both branches share the same target layout (`RNTester`, `RNTesterUnitTests`, `RNTesterIntegrationTests`, `RNTester-macOS`, `RNTester-macOSUnitTests`, `RNTester-macOSIntegrationTests`, `RNTester-visionOS`). `pod install` regenerates the workspace from this file + the Podfile, so any drift between branches gets reconciled by the install step. If maintainers have a preferred way to regenerate the pbxproj (script, fresh `pod init` flow), this PR can be closed in favor of that. The change is offered as the minimal unblock so contributors can resume validation against `0.83-merge`. Indirectly unblocks the **"RNTester validation"** item on the Road to 0.83 tracking issue (microsoft#2901) — that item can't proceed until pod install works on `0.83-merge`. - **Before:** `pod install` in `packages/rn-tester` on `0.83-merge` fails with `[!] The plist file at path .../project.pbxproj doesn't exist.` Reproducible on any fresh `0.83-merge` checkout. `yarn prepare-ios` hits the same error inside the cocoapods-runner subprocess. - **After:** `pod install` in `packages/rn-tester` on `0.83-merge` completes with `Pod installation complete! There are 86 dependencies from the Podfile and 85 total pods installed.` `RNTesterPods.xcworkspace/contents.xcworkspacedata` is generated, all `Pods-RNTester*` xcconfig files are written, hermes-engine script phases are wired. (Validated locally with HEAD = current `0.83-merge` tip.) - Remaining `[!] ... CLANG_CXX_LANGUAGE_STANDARD override` warnings are pre-existing on `main` and unrelated to this restore. ## Related - microsoft#2901 — Road to 0.83 tracking issue (this unblocks RNTester validation) - Upstream blob on \`main\`: SHA \`90e6c295ce0ec461333aa96af37d8b0ceebe98dc\` (120,346 bytes)
## Summary: Followup to microsoft#2958 , whose repo is still locked so we can't edit it. Extend RCTUIKit support to SwiftUI ## Test Plan: CI should pass
…icrosoft#3009) ## Summary Supersedes microsoft#2964. Two small JS fixes from the 0.83 merge audit. **`TouchableBounce.js`** — add the `onPress !== undefined` guard to the macOS `focusable` check (matches upstream 0.83). A `TouchableBounce` with no `onPress` is no longer Tab/VoiceOver focusable. **`AccessibilityInfo.js`** — drop the macOS carve-outs in `isBoldTextEnabled` and `isReduceTransparencyEnabled` so both use upstream's android-first guard and fall through to native on macOS, like their siblings (`isReduceMotionEnabled`, `isInvertColorsEnabled`): - `isReduceTransparencyEnabled` now returns the real macOS "Reduce Transparency" setting instead of a hardcoded `false` — the native side already tracks and live-updates it. - `isBoldTextEnabled` still returns `false` on macOS (no native value), now with zero fork divergence. Both methods now match upstream exactly, aside from the fork-wide `NativeAccessibilityManagerApple` rename. ## Test plan - macOS: `isReduceTransparencyEnabled` reflects the System Settings toggle; `isBoldTextEnabled` stays `false`. - `TouchableBounce` without `onPress` is not focusable. - iOS / Android unchanged; no type changes. Related: microsoft#2901. Co-authored-by: Thiago Vinhas <thiago@vinhas.net> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
To aid in the merge CI should pass --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…icrosoft#3012) ## Summary Follow-up fix to microsoft#3006, which merged before we had CI testing (oops). Turns out `@compatibility_alias` is not compatible with Swift, so we can't use it. Furthermore, `RCTUIKit` can't have Swift sources as SPM doesn't support mixed language modules yet. So for now, let's move the Swift-only usecase out to RCTSwiftUI, the caller. ## Test Plan Validated locally with Xcode 26.4.1: - Clean `RCTSwiftUI-macOS` Pods target build → **BUILD SUCCEEDED**. - Full `RNTester-macOS` app build → **BUILD SUCCEEDED**. - SwiftPM prebuild (`node scripts/ios-prebuild.js -s` then `-b -p macos`) now compiles `React_RCTUIKit`, `RCTSwiftUI` and `RCTSwiftUIWrapper` with **no "no such module"** error (the previous failure point). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The `scripts/releases/__tests__/snapshot-utils.js` helper does
`require('invariant')`, but `invariant` was never declared in the root
workspace manifest. Under the old `nodeLinker: node-modules` (hoisted)
layout it resolved transitively, so the gap was invisible. After the
0.83 merge brought in `nodeLinker: pnpm` (microsoft#3010), the strict `.store/`
layout no longer hoists it, so Jest fails with "Cannot find module
'invariant'" and takes down the dotslash release-asset test suites
(12 tests across 2 suites).
Add `invariant@^2.2.4` (the version already used elsewhere in the tree)
to the root devDependencies and refresh the lockfile.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
`findExternalLibraries` resolves each dependency's `package.json` to look for `codegenConfig`. Facebook 0.83 added an `ERR_PACKAGE_PATH_NOT_EXPORTED` fallback that searches `require.main.paths` for packages whose `exports` block the `./package.json` subpath (e.g. `commander`, `@react-native/new-app-screen`). Under Yarn's pnpm nodeLinker (microsoft#3010) those packages live under `.store/` and aren't on `require.main.paths`, so the fallback leaves `configFilePath` empty and the next `fs.readFileSync('')` throws `ENOENT: open ''`. That aborts `generate-codegen-artifacts.js`, which fails Podfile evaluation and takes down every RNTester / Prebuild macOS Core build job in CI. Guard the empty path and skip the dependency, matching the pre-0.83 behavior for otherwise-unresolvable deps (both triggering packages have no `codegenConfig`, so nothing is lost). Verified locally: `pod install` for RNTester now completes and codegen artifacts are generated. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
`RCTSwiftUIContainerView.swift` did `import React_RCTUIKit`, matching the module name the podspec used before the 0.83 merge (`module_name "React_RCTUIKit"`, `header_dir "React"`). After merging main, RCTUIKit was relocated to `ReactApple/Libraries/RCTUIKit` (microsoft#2943) and its module was renamed to `RCTUIKit` (podspec `module_name "RCTUIKit"`; Package.swift `reactRCTUIKit = "RCTUIKit"`), with `<React/RCTUIKit.h>` now served via React-Core forwarding headers. Dynamic-framework builds still resolved the old name via the framework, but static-library builds could not find module `React_RCTUIKit`, breaking every strict `Build RNTester / *, static` job: RCTSwiftUIContainerView.swift:9:8: error: Unable to find module dependency: 'React_RCTUIKit' This lone Swift import was the only remaining reference to the pre-merge module name. Align it with the merged tree's `RCTUIKit` module (used by both CocoaPods and SwiftPM). Verified locally: `RCTSwiftUI-macOS` builds (BUILD SUCCEEDED) against the static-library Pods project. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
`@react-native/fantom` imports `metro` and `metro-babel-transformer`
(e.g. `import type {RunServerResult} from 'metro'`) but never declared
them. Under the old hoisted node-modules layout they resolved to the
workspace's metro 0.83.x; under Yarn's pnpm nodeLinker (microsoft#3010) the
package instead resolves `metro` to 0.82.5 (pulled in transitively by the
unused `metro-memory-fs@^0.82.5`), which predates the `RunServerResult`
export, and cannot resolve `metro-babel-transformer` at all. Flow then
fails the JavaScript Tests job:
globalTeardown.js: Cannot import `RunServerResult` ... no `RunServerResult`
export in `metro`
metro-babel-transformer.flow.js: Cannot resolve module
`metro-babel-transformer`
Declare both at `^0.83.3` (matching the rest of the monorepo) so pnpm links
the correct versions. Verified locally: `yarn flow check` reports 0 errors.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…tic builds `RCTSwiftUIContainerViewWrapper.h` imported `<React/RCTUIKit.h>`, which resolved directly when React-RCTUIKit used `header_dir "React"` before the 0.83 merge. After merging main's RCTUIKit relocation (microsoft#2943), React-RCTUIKit uses `header_dir "RCTUIKit"` and `<React/RCTUIKit.h>` is only a React-Core forwarding header. RCTSwiftUIWrapper depends on React-RCTUIKit (not React-Core), so the forwarding header is out of scope and static-library builds failed: RCTSwiftUIContainerViewWrapper.h:9:9: 'React/RCTUIKit.h' file not found (in target 'RCTSwiftUIWrapper-macOS') Import the header directly from the React-RCTUIKit dependency (`<RCTUIKit/RCTUIKit.h>`). Verified locally: `RCTSwiftUIWrapper-macOS` builds (BUILD SUCCEEDED) against the static-library Pods project. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The root package.json pins `eslint-plugin-react-hooks` to
`6.1.0-canary-12bc60f5-20250613` via a `resolutions` entry (with a matching
`_justification`) so linting understands React 19's `component` syntax and
`use()` hook. That resolution was dropped while reconciling package.json
during the 0.83 merge, so the tree installed 5.2.0, which flags valid code:
View.js: React Hook "use" cannot be called at the top level
VirtualView.js: React Hook "useState" is called in function
"createVirtualView" that is neither a React function component nor a
custom React Hook function
Restore the resolution and its justification (matching main). Verified
locally: `yarn lint` passes with 0 errors and `yarn constraints` is clean.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
<!-- Thanks for submitting a pull request! We appreciate you spending the time to work on these changes. Please provide enough information so that others can review your pull request. The four fields below are mandatory. --> <!-- This fork of react-native provides React Native for macOS for the community. It also contains some changes that are required for usage internal to Microsoft. We are working on reducing the diff between Facebook's public version of react-native and our microsoft/react-native-macos fork. Long term, we want this fork to only contain macOS concerns and have the other iOS and Android concerns contributed upstream. If you are making a new change then one of the following should be done: - Consider if it is possible to achieve the desired behavior without making a change to microsoft/react-native-macos. Often a change can be made in a layer above in facebook/react-native instead. - Create a corresponding PR against [facebook/react-native](https://github.com/facebook/react-native) **Note:** Ideally you would wait for Facebook feedback before submitting to Microsoft, since we want to ensure that this fork doesn't deviate from upstream. --> ## Summary: Fixing visionOS build - `RCTUITextView` and `RCTUITextField.mm`'s `setDisableKeyboardShortcuts` has some code behind an iOS ifdef. This causes the complier to complain that we never set the ivar. Move the ivar. - `interfaceOrientationDidChange` is behind an iOS ifdef. The usage of it should be too ## Test Plan: <!-- Demonstrate the code is solid. Example: The exact commands you ran and their output, screenshots / videos if the pull request changes the user interface. --> Local build
React Native 0.83 removed the legacy architecture as a supported runtime path — `RCTBridge` now throws on legacy-arch init and there is no opt-out. The `oldarch` matrix jobs only ever compiled RNTester (CI never launches the app), so they provided compile-only coverage of a runtime path that no longer works. Drop the architecture axis entirely (halving the matrix from 12 to 6 jobs), hardcode `RCT_NEW_ARCH_ENABLED=1`, and simplify job names to `<platform>, <linkage>`. New Architecture coverage is unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
## Summary Merge up to the merge base of `0.83-stable` (the first commit on the upstream `0.83-stable` branch, `a034841fd68`), prepping this branch for the 0.83 release. For the cross-platform 0.83 changes (React 19.2, DevTools, Web Performance APIs, etc.), see the [RN 0.83 release notes](https://reactnative.dev/blog/2025/12/10/react-native-0.83). New for react-native-macos since 0.81: **Build & distribution** - feat: add support for dynamic frameworks (microsoft#2943) - feat(macos): migrate init template from Objective-C to Swift (microsoft#2948) - feat(ci): prebuild React xcframework for macOS (microsoft#2920) - feat: build React Native macOS with Swift Package Manager (microsoft#2815) **SwiftUI & RCTUIKit** - fix(0.83, RCTUIKit): extend support to SwiftUI (microsoft#3006) - fix(0.83, rctuikit): make SwiftUI platform aliases visible to Swift (microsoft#3012) - fix(macos): include React-RCTUIKit.podspec in package files array (microsoft#2963) **Fabric / New Architecture on macOS** - feat: handle right clicks properly (microsoft#2885) - fix(macos): TextInput Fabric commands — setGhostText, blur, and selection fixes (microsoft#2912) - fix(fabric): textInput text color not adapting to appearance changes (microsoft#2913) - fix(fabric): multiline text input focus ring and input focus handling (microsoft#2972) - fix(fabric): force overlay scrollbar style in ScrollView (microsoft#2907) - fix(macos): don't reset prop-derived state during Fabric view recycle (microsoft#3008) - fix(macos): three Fabric focus regressions — blur, sendAccessibilityEvent, VirtualView (microsoft#3015) - fix(macos): align TouchableBounce & AccessibilityInfo with upstream (microsoft#3009) - fix: replace RCTUISecureTextField `#include` hack with proper subclass (microsoft#2895) **Hermes, autolinking & CI** - fix(0.83, hermes): resolve hermes from version files instead of merge-base (microsoft#3011) - chore: support Yarn's pnpm nodeLinker (microsoft#3010) - chore: add support for macos platform key in autolinking config (microsoft#2995) - fix(codegen): use REACT_NATIVE constant for npmPackageName (microsoft#2956) ## Test Plan CI green: JavaScript Tests (Jest/Flow/ESLint/Prettier), RNTester static builds (iOS/macOS/visionOS), and Prebuild macOS Core. Full RNTester-macOS static build also verified locally (`BUILD SUCCEEDED`).
Syncs microsoft/react-native-macos main (0.83-line stabilization, ef09dd7) into our hand-ported 0.85 fork. Most of the 35 conflicts are "0.83-era theirs vs 0.85-era ours" where ours wins outright (package versions, Hermes pins, VirtualView/VirtualViewExperimental shape, RCTSwiftUI/RCTUIKit layout). A handful of genuine upstream macOS fixes were folded in by hand: - RCTViewComponentView.mm: adopt upstream 31e47c8 (stop resetting allowsVibrancy/acceptsFirstMouse/mouseDownCanMoveWindow on Fabric view recycle) and d64dcd3's blur guard (only clear first responder if this view still owns it). - RCTUITextView.mm: take upstream wholesale (superset of our focus-ring fix, plus a visionOS keyboard-shortcuts fix). - AccessibilityInfo.js: adopt upstream's removal of the macOS early-returns in isBoldTextEnabled/isReduceTransparencyEnabled now that the native support is verified present on both trees. - React-FabricComponents.podspec: comment out the scrollview subspec (upstream 6014c2c) to stop duplicate-symbol linking against React-Fabric's own recursive scrollview glob. - .github/actions/setup-xcode, react-native.config.js: take upstream (Xcode 26.2 default + platform input; CLI config-load hardening). - package.json: union in upstream's fork-only lint/CI devDeps (workspace:* eslint packages, @typescript-eslint/eslint-plugin, jsonc-eslint-parser, yargs) on top of our 0.85 script set. - rn-tester/Podfile: hoist upstream's $RN_PLATFORMS before pod evaluation. - private/helloworld/Gemfile: dedupe the nkf/base64 gems, keep ffi/ rexml additions from both sides. Post-merge cleanup for auto-merged (non-conflicted) landmines: git's rename detection silently relocated our React/RCTUIKit sources and React-RCTUIKit.podspec to upstream's ReactApple/Libraries/RCTUIKit layout (module "RCTUIKit") with no conflict markers. Reverted to our original path/module ("React_RCTUIKit" at React/RCTUIKit, podspec at package root) across Package.swift, React-Core.podspec, react_native_pods.rb, and RCTSwiftUI.podspec, and deleted the upstream-relocated duplicate tree, its React/RCTUIKit.h compat umbrella, and the orphaned React/RCTPlatformDisplayLink.h stub. The previously-flagged virtualviewexperimental C++ resurrection did not actually recur in this merge. yarn.lock and packages/rn-tester/Podfile.lock were regenerated via `yarn install` rather than hand-merged; `packages/react-native/ package.json` keeps version 0.85.4 (never upstream's 1000.0.0 placeholder).
The merge introduced a redundant nested `#if !TARGET_OS_OSX` guard before -canBecomeFirstResponder without a matching #endif, leaving the outer guard (opened earlier in the file) unterminated through EOF. This broke compilation on both iOS and macOS. The nested guard was unnecessary since the whole block is already inside the outer guard.
…NTester-macOS linker duplicates RNTester's codegenConfig scans jsSrcsDir "." (its own package root) with type "all". Because rn-tester/package.json also carries a devDependency on "react-native-macos" (added in microsoft#2529 to expose CLI commands), yarn creates a node_modules/react-native-macos symlink back into packages/react-native. combine-js-to-schema's directory-expansion glob had no node_modules exclusion, so scanning "." recursively walked that symlink and re-ingested every core Native*.js/NativeComponent spec file, in addition to the specs already generated separately for React-RCTFBReactNativeSpec (core specs have their own dedicated discovery/output path). The result: AppSpecs's generated ReactCodegen pod defined the exact same ObjC classes and C++ symbols (e.g. NativeLogBoxSpecBase, ActivityIndicatorViewProps) as React-RCTFBReactNativeSpec, and the macOS linker failed with 259 duplicate symbol errors when both static libraries were linked into RNTester-macOS. Excluding **/node_modules/** from the recursive glob keeps each library's own jsSrcsDir scan scoped to its own sources, matching how per-library codegen discovery/output routing already works for every other library. Also regenerated packages/rn-tester/Podfile.lock via a clean `bundle exec pod install` after the fix, which was needed to build from source in this sandbox (no access to fetch the usual prebuilt React-Core/RN dependency binaries). Verified: `xcodebuild -workspace RNTesterPods.xcworkspace -scheme RNTester-macOS -configuration Debug -destination "platform=macOS" build` now succeeds (0 errors) and produces RNTester-macOS.app.
…upstream Text.js called ReactNativeFeatureFlags.reduceDefaultPropsInText() and .shouldUseLinkRoleForPressableText() unconditionally at module-eval time, but neither getter exists in this fork's generated flag registry, crashing any app that renders <Text> (papered over downstream by a patch-package patch in uno-infra's desktop app). Root cause: these are not flags this fork's manual port dropped from the config - ReactNativeFeatureFlags.config.js already correctly reflects upstream's current, post-retirement state (verified against upstream-rn commits 68e5b4e and 680bd5a, and upstream-rn/main, none of which reference these flags any more; both graduated to permanent `true` behavior). The bug is that this fork's Text.js is a stale pre-retirement copy that still branches on them - most likely a merge conflict that was resolved by keeping the fork's older Text.js content instead of upstream's newer file, while the (non-conflicting) config.js was reconciled correctly. Fix Text.js at the source to match upstream's graduated behavior instead of resurrecting retired flags: - Drop the ReactNativeFeatureFlags import. - Collapse the reduceDefaultPropsInText()-gated TextImplNoDefaultProps / TextImplLegacy branches into the single TextImplNoDefaultProps implementation (upstream's permanent behavior since react#55292). - Compute shouldUseLinkRole unconditionally, without the retired shouldUseLinkRoleForPressableText() guard (upstream's permanent behavior since react#55121). - Preserve this fork's macOS-only borderRadius/backgroundColor spill workaround, now present once instead of duplicated across both branches. No feature-flag config or codegen changes were needed/made since the registry already omitted these flags correctly.
globSync passed micromatch.isMatch() absolute file paths, but micromatch's `**` does not traverse hidden (dot-prefixed) path segments by default. Any checkout living under a dotdir (e.g. a git worktree at .claude/worktrees/...) made every IGNORE_PATTERN and JS_FILES_PATTERN match silently fail, so buildFile() fell through to the "not a JS file" branch and copied every .js file into lib/ verbatim instead of Babel-transpiling it — producing a broken, un-transpiled package build with no error. Match against the path relative to PACKAGE_DIR instead, which never contains dot-segments regardless of where the repo is checked out. Verified: `rm -rf lib && node scripts/build.js` now produces Babel-transpiled output in lib/ (Flow syntax stripped, generics removed) with a stripped-source .js.flow sidecar per typed file, and correctly excludes __tests__/__test_fixtures__. Re-ran generate-codegen-artifacts.js against packages/rn-tester and confirmed AppSpecs-generated.mm still has exactly one @implementation block (no regression of the earlier RNTester-macOS linker fix).
Author
Follow-up commits
Noted but out of scope for this PR: a pre-existing |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
upstream-macos/main(microsoft/react-native-macos) into our hand-ported 0.85 macOS fork, resolving 35 real conflicts (mechanical version/lockfile files kept at our0.85.4, native macOS fixes reconciled file-by-file rather than blindly taken from either side).#if !TARGET_OS_OSX/#endifinRCTViewComponentView.mmintroduced during conflict resolution (caught by an independent review pass before this ever reached a real compile).RNTester-macOSbuild:rn-tester'scodegenConfigscan (jsSrcsDir: ".") walked into anode_modules/react-native-macosself-symlink and re-ingested every coreNative*/*NativeComponentspec already generated separately forFBReactNativeSpec, producing duplicate ObjC/C++ symbols at link time. Fixed by excludingnode_modulesfrom the codegen glob inpackages/react-native-codegen.AccessibilityInfonow calls into the native module forisBoldTextEnabled/isReduceTransparencyEnabledinstead of hard-returningfalse;RCTUITextView.mmfocus-ring handling picked up upstream's explicit getter + a visionOS ivar-placement fix; CI'ssetup-xcodeaction bumped to upstream's newer default + platform-download input.packages/react-native/package.jsonversion confirmed to stay0.85.4— upstreammain's1000.0.0is their unreleased-trunk placeholder, not a real version.Validation
yarn install,yarn lint --max-warnings 0— pass, 0 errors.bundle exec pod installinpackages/rn-tester— succeeds.xcodebuild -workspace RNTesterPods.xcworkspace -scheme RNTester-macOS -configuration Debug -destination "platform=macOS" build— BUILD SUCCEEDED.flow-check/jestcould not run — confirmed pre-existing environment gaps (flow-bin/.flowconfigversion mismatch, pnpm-strict-linking module resolution), unrelated to this merge, identical at pre-merge HEAD.Known follow-ups (not blocking, tracked separately)
reduceDefaultPropsInText/shouldUseLinkRoleForPressableTextText.js feature-flag getters are still absent from the generated flag registry post-merge (pre-existing gap) — the downstreamuno-infradesktop app's patch-package patch is still required for this.packages/react-native-codegen'sscripts/build.jshas amicromatch-absolute-path bug that silently no-ops the Babel transpile step (worked around locally for this pass, not fixed upstream in this PR).🤖 Generated with multi-agent research (Fable 5) + merge/build/verify (Sonnet 5).