Skip to content

chore(deps-dev): bump @react-native-community/cli-platform-ios from 18.0.0 to 20.2.0#575

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/react-native-community/cli-platform-ios-20.2.0
Open

chore(deps-dev): bump @react-native-community/cli-platform-ios from 18.0.0 to 20.2.0#575
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/react-native-community/cli-platform-ios-20.2.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps @react-native-community/cli-platform-ios from 18.0.0 to 20.2.0.

Release notes

Sourced from @​react-native-community/cli-platform-ios's releases.

v20.2.0

Changes

🚀 Features

🐛 Bug Fixes

🧰 Maintenance

Full Changelog: react-native-community/cli@v20.1.1...v20.2.0

v20.1.1

What's Changed

New Contributors

Full Changelog: react-native-community/cli@v20.1.0...v20.1.1

v20.1.0

What's Changed

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 6, 2026
@vercel

vercel Bot commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
drafto Ready Ready Preview, Comment Jul 6, 2026 10:14pm

@JakubAnderwald JakubAnderwald added the needs-review Needs manual review label Jul 6, 2026
@JakubAnderwald

JakubAnderwald commented Jul 6, 2026

Copy link
Copy Markdown
Owner

Nightly dependency review — major version bump flagged for manual review.

CI is fully green on this PR, but this is a major bump (18 → 20) crossing two majors, so per policy I'm flagging rather than auto-merging.

  • Package: @react-native-community/cli-platform-ios, 18.0.0 → 20.2.0 — dev dependency (devDependencies) in apps/desktop/package.json:45. Not imported in any source file; it's a build/CLI plugin invoked by @react-native-community/cli for iOS build/run commands.

  • Breaking changes relevant to this codebase: None directly exercised. The desktop app builds macOS via react-native run-macos (apps/desktop/package.json:8), not iOS, so this iOS platform plugin is off the critical build path. The v20 iOS behavior changes never run in our workflow. CI confirms: Desktop Checks, Mobile Checks, E2E, Lint & Typecheck, and Unit/Integration all pass.

  • Breaking changes NOT relevant (iOS-only, we don't run them):

    • "never default to a connected device on plain run-ios" (#2795) — we use run-macos.
    • Xcode 27 DeviceHub support (#2806), getBuildSettings target fix (#2801), fallback-simulator launch (#2778) — iOS simulator/device tooling, unused here.
    • Security-positive: RCE fix in openURLMiddleware (CVE-2025-11953, v20.1.1) and fast-xml-parser CVE bumps — dev-tooling hardening, no downside.

  • Peer dependency impacts: ⚠️ The real concern. apps/desktop pins both @react-native-community/cli@18.0.0 (:44) and @react-native-community/cli-platform-ios@18.0.0 (:45), and react-native@0.86.0 / react-native-macos@0.81.7 both resolve @react-native-community/cli@18.0.0 throughout the lockfile. This PR bumps only the iOS plugin to 20.2.0, leaving the main CLI at 18 — a version skew within a single monorepo family that is meant to be version-aligned. pnpm resolves it and CI passes, but the two are designed to move together.

  • Recommendation: Low functional risk to merge as-is (dev-only tool, off the macOS build path, CI green), but the cleaner action is to keep the CLI family aligned rather than merge a lone-plugin skew. Preferred options for the reviewer:

    1. Close/hold this PR and instead bump the whole @react-native-community/cli* family (incl. @react-native-community/cli@18→20) together to match, or
    2. Merge as-is if you want the security fixes now and are comfortable with the temporary 18/20 skew (no user-facing impact — dev tooling only).

@dependabot
chore(deps-dev): bump @react-native-community/cli-platform-ios
4d5af5e 
Bumps [@react-native-community/cli-platform-ios](https://github.com/react-native-community/cli/tree/HEAD/packages/cli-platform-ios) from 18.0.0 to 20.2.0.
- [Release notes](https://github.com/react-native-community/cli/releases)
- [Changelog](https://github.com/react-native-community/cli/blob/main/packages/cli-platform-ios/CHANGELOG.md)
- [Commits](https://github.com/react-native-community/cli/commits/v20.2.0/packages/cli-platform-ios)

---
updated-dependencies:
- dependency-name: "@react-native-community/cli-platform-ios"
  dependency-version: 20.2.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/react-native-community/cli-platform-ios-20.2.0 branch from 427c6e4 to 4d5af5e Compare July 6, 2026 22:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code needs-review Needs manual review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@JakubAnderwald