chore(react-native): coordinate runtime and toolchain upgrades

[Charles Hudson (phobetron)]

Independent React Native tooling upgrades left the reference implementation on React Native 0.84 while selecting Metro and Gradle tooling from 0.87, breaking asset resolution and the Android build. This change upgrades the implementation to React Native 0.87.1 as a complete native migration and groups future related Renovate updates for maintainer review.

Supersedes #533 and #534.

Changes

• Align the React Native runtime and its Metro config, Gradle plugin, Codegen, Babel preset, and Jest preset at 0.87.1. Keep the compatible React 19.2.3 and CLI 20.2.0 versions; update screens to 4.27.0 and safe-area-context to 5.10.1 for native compatibility.
• Update Android to Gradle 9.4.1, Kotlin 2.2.0, compile SDK/build tools 37, the required AGP 9 settings, and the current React Native application startup API.
• Let React Native select its Hermes compiler, with pnpm hoisting it to the location expected by the Gradle plugin, instead of maintaining an independent compiler pin.
• Add the iOS dependency provider, regenerate CocoaPods dependencies and React Native project settings, and align AsyncStorage's resource bundle with the app's iOS deployment minimum for Xcode 27.
• Update the app's Jest configuration for the extracted React Native preset and pnpm/ESM dependencies. Use the dependencies' official native test helpers and wait for SDK initialization in the app render test; keep Detox test discovery separate.
• Group the implementation's related runtime and build-tool dependencies in Renovate, enable Gradle wrapper updates, keep major/minor updates together, and disable automerge for the group. Document the native migration and validation steps still required when reviewing an upgrade.

Validation

Passed locally:

• Implementation lint and TypeScript checks.
• Focused __tests__/App.test.tsx test: 1 passed.
• Android release app and Detox instrumentation build through test:e2e:android:build:release.
• iOS simulator release build through Detox's ios.sim.release configuration.
• Release Detox navigation smoke test on both Android and iOS: e2e/navigation-screen-tracking.test.js, filtered to should track a single view visit (1 passed per platform).
• Repository pnpm format:check, Renovate 44.155.1 repository configuration validation, and native file/Podfile lock consistency checks.

Local E2E validation was deliberately limited to the focused navigation test on each platform; the full suites were not run locally.

[wiz-inc-38d59fb8d7]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	-
Software Management Findings	-
Total	-

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.

[bito-code-review]

Impact Analysis by Bito

Cross-Repository Impact Analysis

What Changed	Impact of Change	Suggested Review Actions
React Native implementation upgrades framework and platform build dependencies.	- verify-needed: React Native 0.84.0 to 0.87.1 dependency set: The organization dependency lookup returned an oversized response that could not be inspected, and no consumer search or call-site verification was completed. - verify-needed: Node.js runtime requirement: The documented minimum is raised to Node.js 24.15.0; external build consumers and automation compatibility were not verified.	- Check dependency-graph consumers and search organization code for the React Native implementation and runtime requirement. - Confirm consumer CI images support Node.js 24.15.0 and the documented Android/iOS toolchains.

Code Paths Analyzed

Impact:
The visible changes upgrade the React Native SDK's framework and native build toolchain, update app startup integration for the new architecture, and document prerequisites and upgrade policy. Full file-level analysis could not be completed within the available tool-operation limit.

Flow:
Node.js and package manager setup → React Native dependency installation → Android Gradle / iOS CocoaPods native build → application startup and JavaScript bundle.

Direct Changes (Diff Files):
• implementations/react-native-sdk/README.md [9-17, 25-48 (visible diff portions)] — Updates Node.js, Android, and iOS prerequisites and adds React Native upgrade guidance.
• implementations/react-native-sdk/android [123-193] — Updates Android host initialization and build tool configuration; build tools and compile SDK move from 36 to 37, Kotlin from 2.1.20 to 2.2.0, with Gradle compatibility properties.
• implementations/react-native-sdk/ios/OptimizationImplementationApp.xcodeproj/project.pbxproj [210-262] — Adds compiler flags and CocoaPods project configuration for the updated React Native build.
• implementations/react-native-sdk/ios/OptimizationImplementationApp/AppDelegate.mm [265-282] — Registers RCTAppDependencyProvider during application startup.
• implementations/react-native-sdk/ios/OptimizationImplementationApp/Info.plist [285-295] — Enables the React Native new architecture.
• implementations/react-native-sdk/ios/Podfile [299-303] — Updates iOS CocoaPods configuration.
• implementations/react-native-sdk/ios/Podfile.lock [301-2546] — Refreshes native pod versions and dependency resolution, including React Native 0.84.0 to 0.87.1 and CocoaPods metadata.
• implementations/react-native-sdk/jest.config.js [2550-2555] — Switches to the React Native Jest preset package.
• implementations/react-native-sdk/other SDK package and automation configuration [2556-2695] — The diff tail includes further configuration changes; the complete changed-file inventory was not available for reliable per-file attribution.

Repository Impact:
• React Native SDK Android and iOS build pipeline: Framework, native dependency lockfile, compiler, SDK, and build-tool settings change together.
• Application startup and new architecture: Android initialization is simplified and iOS explicitly enables/registers new-architecture components.
• JavaScript test configuration: The Jest preset changes and should be validated against the SDK's tests.

Cross-Repository Dependencies:
• Potential SDK consumers and CI/build repositories: The changed runtime and native build prerequisites may affect consumers, but dependency graph results could not be read.

Database/Caching Impact:
• None

API Contract Violations:
• No application-level endpoint or exported API change was established from the inspected diff portions.

Infrastructure Dependencies:
• Node.js 24.15.0 is now the documented prerequisite.
• Android build requires JDK 17 and Android SDK platform/build tools 37.
• iOS build requires Xcode 26 or later and CocoaPods; the lockfile records a CocoaPods version change from 1.15.2 to 1.17.0.
• Gradle wrapper changes from 9.3.1 to 9.4.1.

Additional Insights:
• React Native new architecture: The iOS plist enables RCTNewArchEnabled and AppDelegate registers RCTAppDependencyProvider; exercise native module initialization on both platforms.

Testing Recommendations

Frontend Impact:
• Run the React Native SDK app on Android and iOS simulators with the new architecture enabled; verify launch and core screens.

Service Integration:
• Run Android and iOS Detox flows using the documented JDK 17, SDK 37, Xcode 26+, and CocoaPods toolchain.

Data Serialization:
• None.

Privacy Compliance:
• None.

Backward Compatibility:
• Validate that supported consumer/build environments can install dependencies and build with Node.js 24.15.0; assess whether dropping the documented Node.js 20.19.0 minimum is intentional.

OAuth Functionality:
• None

Reliability Testing:
• None

Additional Insights:
• Run the Jest suite after switching to @react-native/jest-preset.
• Perform clean Android Gradle and iOS pod installs to verify lockfile reproducibility and React Native 0.87.1 native module autolinking.
• The requested organization-wide consumer search and complete changed-file review remain unverified.

_{Analysis based on known dependency patterns and edges. Actual impact may vary.}

[bito-code-review]

Code Review Agent Run #994838

Actionable Suggestions - 1

• renovate.json - 1

  • CWE-1078: Dead matchPackageNames entry · Line 64-64

Additional Suggestions - 2

• implementations/react-native-sdk/README.md - 1

  • Node minimum dropped from docs · Line 42-42
    The rewritten prerequisite drops the documented Node floor: the root `package.json` `engines` field still requires `>=20.19.0`, but this line now states only `24.15.0`. Contributors on Node 20/22, which the repo's own engine check accepts, would read this implementation as requiring 24.15.0. Keep the minimum alongside the `.nvmrc` recommendation.
• implementations/react-native-sdk/ios/Podfile - 1

  • Misleading comment version · Line 40-40
    The comment cites 'Xcode 27', a version that does not correspond to any released Xcode; the code's actual mechanism is overriding the resource-bundle target's IPHONEOS_DEPLOYMENT_TARGET with `min_ios_version_supported` (defined by `react_native_pods.rb`, already used on line 6). A wrong tool version in the comment will mislead maintainers debugging this workaround. State the real motivation (deployment-target mismatch failures in current Xcode) or drop the version claim.

Review Details

• Files reviewed - 17 · Commit Range: ce2ea01..ce2ea01

  • implementations/react-native-sdk/README.md
  • implementations/react-native-sdk/__tests__/App.test.tsx
  • implementations/react-native-sdk/android/app/build.gradle
  • implementations/react-native-sdk/android/app/src/main/java/com/reactnativeapp/MainApplication.kt
  • implementations/react-native-sdk/android/build.gradle
  • implementations/react-native-sdk/android/gradle.properties
  • implementations/react-native-sdk/android/gradle/wrapper/gradle-wrapper.properties
  • implementations/react-native-sdk/ios/OptimizationImplementationApp.xcodeproj/project.pbxproj
  • implementations/react-native-sdk/ios/OptimizationImplementationApp/AppDelegate.mm
  • implementations/react-native-sdk/ios/OptimizationImplementationApp/Info.plist
  • implementations/react-native-sdk/ios/Podfile
  • implementations/react-native-sdk/ios/Podfile.lock
  • implementations/react-native-sdk/jest.config.js
  • implementations/react-native-sdk/jest.setup.ts
  • implementations/react-native-sdk/package.json
  • implementations/react-native-sdk/pnpm-workspace.yaml
  • renovate.json
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful
  • OWASP (Security Vulnerability) - ✔︎ Successful
  • GITHUB_ADVISORY (Security Vulnerability) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers an incremental AI Review.

• /review full - Manually triggers a full AI Review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at jared.jolton@contentful.com.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[bito-code-review]

✅ Review Settings Overridden

Status: Overridden Successfully

Guidelines:

• Accepted:

  • General : Review Posture, Repo Truth And Boundaries, Domain Invariants

  • Language : typescript= TypeScript Review Evidence

Note: Extra guidelines beyond 3 general purpose guidelines and 1 language specific guideline per language are not processed. Guidelines are fetched from the source branch.

[bito-code-review]

Code Review Agent Run #4689a6

Actionable Suggestions - 2

• implementations/react-native-sdk/README.md - 1

  • Inconsistent Xcode version · Line 47-47
• renovate.json - 1

  • React alignment pin dropped · Line 50-74

Additional Suggestions - 1

• implementations/react-native-sdk/ios/Podfile - 1

  • Podfile target name may not match · Line 42-42
    The guard `next unless target.name == 'AsyncStorage-AsyncStorage_resources'` depends on the exact CocoaPods resource-bundle target name. If AsyncStorage's podspec names its bundle differently, the loop silently no-ops and the iOS 13 deployment target is never raised. Please confirm the target name against the installed podspec (or match by prefix).

Review Details

• Files reviewed - 17 · Commit Range: b8e62d5..b8e62d5

  • implementations/react-native-sdk/README.md
  • implementations/react-native-sdk/__tests__/App.test.tsx
  • implementations/react-native-sdk/android/app/build.gradle
  • implementations/react-native-sdk/android/app/src/main/java/com/reactnativeapp/MainApplication.kt
  • implementations/react-native-sdk/android/build.gradle
  • implementations/react-native-sdk/android/gradle.properties
  • implementations/react-native-sdk/android/gradle/wrapper/gradle-wrapper.properties
  • implementations/react-native-sdk/ios/OptimizationImplementationApp.xcodeproj/project.pbxproj
  • implementations/react-native-sdk/ios/OptimizationImplementationApp/AppDelegate.mm
  • implementations/react-native-sdk/ios/OptimizationImplementationApp/Info.plist
  • implementations/react-native-sdk/ios/Podfile
  • implementations/react-native-sdk/ios/Podfile.lock
  • implementations/react-native-sdk/jest.config.js
  • implementations/react-native-sdk/jest.setup.ts
  • implementations/react-native-sdk/package.json
  • implementations/react-native-sdk/pnpm-workspace.yaml
  • renovate.json
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful
  • OWASP (Security Vulnerability) - ✔︎ Successful
  • GITHUB_ADVISORY (Security Vulnerability) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers an incremental AI Review.

• /review full - Manually triggers a full AI Review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at jared.jolton@contentful.com.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[Charles Hudson (phobetron)]

Responses to the remaining Bito review comments, checked against the current PR and cleanup commit 754b77e:

Review run #994838

Review

• Unused Hermes matcher: fixed in 754b77e, with a reply on the original inline thread. The compiler remains owned by React Native and publicly hoisted by pnpm. Formatting and Renovate 44.155.1 repository-config validation pass.
• Node minimum dropped from the README: restoring >=20.19.0 would be inaccurate for this implementation. React Native 0.87.1 declares ^22.13.0 || ^24.3.0 || >=26.0.0; the root package's broader engine range does not establish compatibility for every reference implementation. The documented Node 24.15.0 matches .nvmrc, pnpm-workspace.yaml's nodeVersion, and the CI jobs' node-version-file: '.nvmrc'. Retaining the prescribed repository runtime.
• Xcode 27 allegedly unreleased: contradicted by the actual toolchain used for validation: xcodebuild -version reports Xcode 27.0, build 27A266a. The iOS release build and focused Detox navigation test passed with that toolchain. The Podfile comment records a verified environment-specific deployment-target mismatch; it is accurate.

Review run #4689a6

Review

• Xcode prerequisite inconsistency: addressed in the inline thread. Xcode 26 or later includes 27; documenting the environment that exposed a workaround does not raise the minimum requirement.
• React alignment rule removed: addressed in the inline thread. Allowing grouped, maintainer-reviewed upgrade proposals is intentional. Applying enabled: false to the suggested rule would disable the entire group and contradict this PR's purpose. The README explicitly requires compatibility review and native project migration; grouping is not presented as automatic version alignment.
• AsyncStorage target name may not match: verified directly against the installed podspec and generated Pods project. The podspec names the pod AsyncStorage and its resource bundle AsyncStorage_resources; the generated target is exactly AsyncStorage-AsyncStorage_resources. Both Debug and Release configurations report IPHONEOS_DEPLOYMENT_TARGET = 15.1. The release build and focused iOS Detox test also passed. No prefix match or broader override is needed.

Impact analysis and review-settings notice

Impact analysis: the requested runtime, dependency, build, and launch checks have been performed. CI takes Node from .nvmrc; the regenerated Podfile.lock was reviewed; Android release/instrumentation and iOS simulator release builds passed; and one existing navigation-and-screen-tracking Detox test passed on each platform. Android release minification remains disabled, so changing the supported default ProGuard configuration file does not enable shrinking. The changed paths are the private reference implementation and repository Renovate configuration, not published SDK source or service contracts. An organization-wide consumer search is not warranted without a concrete affected external consumer. Local E2E was deliberately limited to the focused test per platform, as recorded in the PR description.

Review-settings notice: acknowledged; this administrative notice does not request a code change.

Each inline suggestion has a reply on its original thread. The three inline threads are being marked resolved directly rather than waiting for automated resolution.

[bito-code-review]

Code Review Agent Run #8ffce9

Actionable Suggestions - 0

Review Details

• Files reviewed - 1 · Commit Range: b8e62d5..754b77e

  • renovate.json
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers an incremental AI Review.

• /review full - Manually triggers a full AI Review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at jared.jolton@contentful.com.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by