Repository navigation
chore: drop the expired release-age exclusions - #6547
Merged
saddlepaddle merged 2 commits intoAug 17, 2026
Merged
Conversation
The Expo SDK 56 batch (expo-modules-core@56.0.23 and its same-day module set, plus react-native-screens@4.26.0) was bumped on 2026-08-13 and has now cleared the 3-day minimumReleaseAge floor, so the exclusions that forced it to resolve together are dead weight. Every package is pinned exact in apps/mobile/package.json, so removing them is a resolution no-op: all 15 versions are unchanged after bun install, and bun.lock is byte-identical.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
Included review availability: Your plan includes up to 10 reviews per rolling hour; 2 remain after this review. 📝 WalkthroughWalkthroughThe Bun install configuration removes the complete Changes
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This localized configuration change restores release-age protection for all dependencies without changing resolved versions; the lockfile is unchanged and lint and typecheck pass. No actionable merge-blocking risk remains beyond normal checks. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The next/@next/*, hono, and @xterm/* exclusions have all passed the expiry dates their own comments set (2026-07-24, 2026-08-06, and 2026-07-16). Every pinned version now clears the 3-day floor on its own: next 16.2.11 is 26d old, hono 4.12.34 is 13d, and the @XTerm betas are 7-34d. All are pinned exact in package.json, so removal is a resolution no-op -- bun install reports no changes and bun.lock is unchanged. Dropping next and hono in particular restores the supply-chain detection window on the two most attack-attractive packages here; a standing exclusion would install a compromised publish immediately. The dated comments show the intended pattern is a scoped exclusion added when a bypass is actually needed. With no entries left, minimumReleaseAgeExcludes is removed entirely.
saddlepaddle
changed the title
Contributor
🧹 Preview Cleanup CompleteThe following preview resources have been cleaned up:
Thank you for your contribution! 🎉 |
saddlepaddle
deleted the
drop-expired-expo-release-age-2026-08-17-00-00-03
branch
August 17, 2026 00:15
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Removes every entry from
minimumReleaseAgeExcludesinbunfig.toml, along with the comment blocks explaining them. With no entries left, the key itself is gone;minimumReleaseAge = 259200stays and now applies to everything.Two commits, so the Expo batch can be reviewed separately from the rest:
expo,expo-asset,expo-constants,expo-dev-client,expo-file-system,expo-font,expo-image,expo-image-manipulator,expo-image-picker,expo-linking,expo-media-library,expo-modules-core,expo-router,expo-web-browser,@expo/ui,react-native-screensnext, the eight@next/*binaries,hono, and the ten@xterm/*packagesWhy
Each of these was a dated, temporary bypass, and every one has passed the expiry its own comment set:
Symbol not foundexpo-modules-core@56.0.23et alnext+@next/*(9)hono(1)@xterm/*(10)Worth calling out for
nextandhonospecifically: these are the most attack-attractive dependencies in the repo, and a standing exclusion means a compromised publish of either would install immediately.minimumReleaseAgeexists to buy a detection window exactly there, so removing them restores the protection where it matters most. The dated comments show the intended pattern is to add a narrow exclusion at the moment a bypass is genuinely needed, not to leave one standing.Verification
Resolution is completely unchanged — this only affects which versions bun is willing to resolve, and every package here is pinned exact in
package.json, so the exclusions never had anything left to do.bun installreportsChecked 3014 installs across 3337 packages (no changes)andbun.lockis byte-identical (git diff bun.lockis empty).bunfig.tomlis the only changed file.All 15 Expo packages resolve identically before and after:
And the rest:
next16.2.11,hono4.12.34,@xterm/xterm6.1.0-beta.289,@xterm/addon-webgl0.20.0-beta.297,@xterm/addon-ligatures0.11.0-beta.220 (still held at beta.220 — its beta.289 bundle importsnode:diagnostics_channel, which breaks the vite renderer build; it was never in the exclusion list and is unaffected).bun run lintandbun run typecheckboth pass.Summary by CodeRabbit