Skip to content

Upgrade to React Native 0.83.2 with new architecture#6047

Open
j0ntz wants to merge 4 commits into
developfrom
jon/upgrade-latest-rn
Open

Upgrade to React Native 0.83.2 with new architecture#6047
j0ntz wants to merge 4 commits into
developfrom
jon/upgrade-latest-rn

Conversation

@j0ntz

@j0ntz j0ntz commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

CHANGELOG

Does this branch warrant an entry to the CHANGELOG?

  • Yes
  • No

Dependencies

none

Requirements

If you have made any visual changes to the GUI. Make sure you have:

  • Tested on iOS device
  • Tested on Android device
  • Tested on small-screen device (iPod Touch)
  • Tested on large-screen device (tablet)

Description

Asana: https://app.asana.com/0/1215088146871429/1215939017452147

Upgrade edge-react-gui to React Native 0.83.2 and enable the new architecture (Fabric/TurboModules). This brings the prior WIP work (the william/rn83 branch) current with develop, which had since migrated from yarn to npm and advanced several native crypto deps.

Changes:

  • react 19.2.0, react-native 0.83.2, react-native-reanimated 4.2.1 (pinned so it stays compatible with the worklets 0.7.x line), react-native-worklets 0.7.x, react-native-bootsplash 7.x, expo 55.
  • Keep develop's newer native deps: react-native-piratechain 0.6.0, react-native-zcash 0.12.1, react-native-zano 0.3.0.
  • Native iOS: Expo new-architecture AppDelegate (ExpoAppDelegate + ExpoReactNativeFactory), Swift 6 access-level imports, and removal of the now-deleted bindReactNativeFactory call.
  • Native Android: newArchEnabled, gradle/wrapper updates, Kotlin 2.3.20, ext.kspVersion set to the independently-versioned KSP2 line (Kotlin 2.3 has no release in the old <kotlin>-<ksp> scheme the expo gradle plugin looks up), jsMainModulePath = "index" so the new ExpoReactHostFactory loads the JS entry, and a patch for @react-native-community/datetimepicker (Kotlin 2.3 dropped synthetic-property access for getCurrentActivity()).
  • Drop the obsolete r3-hack Reanimated-3 Android workaround in favor of Reanimated 4 under the new architecture.
  • Remove the no-longer-needed react-native 0.79 patch. Add a react-native-reanimated type patch so its animated components type-check as valid JSX under React 19 (@types/react 19.2).
  • Fix the fontSize: 0 crash on outline text inputs: clamp animated icon/text font sizes to a positive value (gui ThemedIcons/FilledTextInput and a patch for edge-login-ui-rn). The new architecture's Android text layout throws IllegalArgumentException: FontSize should be a positive value when an animated size reaches 0; iOS tolerates it. This is the crash the prior attempt flagged ("hidden behind the animated vector icons").

Testing:

  • iOS: builds with Xcode 26.5 and runs on the simulator under the new architecture. Drove onboarding, the PIN screen, and the password login screen; the outline text input focuses and accepts text with its animated label.
  • Android: ./gradlew :app:assembleDebug succeeds; runs on an Android 16 emulator under the new architecture. Reproduced the fontSize: 0 crash on the login screen, applied the clamp fix, and confirmed the login outline inputs now render and accept text without crashing. Screenshots below.
  • tsc --noEmit clean; npm run lint clean; jest 511 tests pass.

Follow-ups:

  • The edge-login-ui-rn font-size fix is shipped here as a patch-package patch against 3.36.0; it should also land upstream in edge-login-ui-rn and then be picked up via a version bump.

Note

High Risk
This is a full-stack native and runtime migration (new architecture, Expo 55, Gradle 9, major pod graph) that can surface build or runtime regressions across iOS and Android until broadly exercised.

Overview
Upgrades the app to React Native 0.83.2 with Fabric/TurboModules turned on (newArchEnabled, RCTNewArchEnabled), alongside Expo 55-style tooling (babel-preset-expo, Expo metro config, and the newer Expo Gradle/CocoaPods autolinking).

Android moves to the RN 0.83 bootstrap (loadReactNative, ExpoReactHostFactory with jsMainModulePath = "index"), compile/target SDK 36, Gradle 9, Kotlin 2.3.20 with an explicit KSP2 version, and drops the old Reanimated-3 r3-hack resolution path. iOS adopts ExpoAppDelegate / ExpoReactNativeFactory, refreshes native deps in Podfile.lock, and wires Expo’s configure-project build phase inputs/outputs.

JS/build simplifies Babel to Expo + react-native-worklets, removes Android-specific Reanimated routing from Metro, and adds a worklets Jest mock. The r3-hack / Flipper-era Android Babel branching is removed in favor of Reanimated 4 under the new architecture.

Reviewed by Cursor Bugbot for commit 1f9665c. Bugbot is set up for automated code reviews on this repo. Configure here.

@j0ntz

j0ntz commented Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

📸 Test evidence: RN 0.83.2 + new architecture on iOS sim

agent proof 1215939017452147 01 app runs under new arch

agent proof 1215939017452147 01 app runs under new arch

agent proof 1215939017452147 02 login outline text inputs

agent proof 1215939017452147 02 login outline text inputs

agent proof 1215939017452147 03 text input focused no fontsize crash

agent proof 1215939017452147 03 text input focused no fontsize crash

Captured by the agent's in-app test run (build-and-test).

@socket-security

socket-security Bot commented Jun 23, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.jsonnpm/react-native-bootsplash@7.3.2npm/jest@30.0.0npm/@emnapi/runtime@1.11.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @expo/cli is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.jsonnpm/expo@55.0.0-preview.9npm/@expo/cli@55.0.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@expo/cli@55.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @expo/cli is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.jsonnpm/expo@55.0.0-preview.9npm/@expo/cli@55.0.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@expo/cli@55.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Publisher changed: npm @expo/log-box is now published by brentvatne

Author: brentvatne

From: package-lock.jsonnpm/expo@55.0.0-preview.9npm/@expo/log-box@55.0.5

ℹ Read more on: This package | This alert | What is unstable ownership?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@expo/log-box@55.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm fast-xml-parser is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.jsonnpm/@react-native-community/cli-platform-android@20.0.0npm/@react-native-community/cli-platform-ios@20.0.0npm/@react-native-community/cli@20.0.0npm/fast-xml-parser@4.5.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fast-xml-parser@4.5.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm node-forge is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.jsonnpm/expo@55.0.0-preview.9npm/@walletconnect/web3wallet@1.10.1npm/node-forge@1.4.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/node-forge@1.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm react-native-bootsplash is 62.0% likely obfuscated

Confidence: 0.62

Location: Package overview

From: package-lock.jsonnpm/react-native-bootsplash@7.3.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-native-bootsplash@7.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm react-native-bootsplash is 60.0% likely obfuscated

Confidence: 0.60

Location: Package overview

From: package-lock.jsonnpm/react-native-bootsplash@7.3.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-native-bootsplash@7.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm react-native is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.jsonnpm/react-native@0.83.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-native@0.83.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @expo/log-box

Location: Package overview

From: package-lock.jsonnpm/expo@55.0.0-preview.9npm/@expo/log-box@55.0.5

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@expo/log-box@55.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm expo-modules-core

Location: Package overview

From: package-lock.jsonnpm/expo@55.0.0-preview.9npm/expo-modules-core@55.0.7

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/expo-modules-core@55.0.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm fetch-nodeshim

Location: Package overview

From: package-lock.jsonnpm/expo@55.0.0-preview.9npm/fetch-nodeshim@0.4.10

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fetch-nodeshim@0.4.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Comment thread ios/edge.xcodeproj/project.pbxproj Outdated
@j0ntz j0ntz force-pushed the jon/upgrade-latest-rn branch 3 times, most recently from d6ef28d to 9ae00f3 Compare June 23, 2026 05:53
@j0ntz

j0ntz commented Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

📸 Android test evidence: RN 0.83.2 + new architecture (Android emulator, iOS 26 toolchain)

agent proof 1215939017452147 04 android new arch

agent proof 1215939017452147 04 android new arch

agent proof 1215939017452147 05 android login input

agent proof 1215939017452147 05 android login input

Captured by the agent's in-app test run (build-and-test).

j0ntz added 2 commits June 22, 2026 23:12
Reconcile the WIP react-native 0.83 / new-architecture work (originally on
the william/rn83 branch) onto current npm-based develop. Bump react 19.2.0,
react-native 0.83.2, react-native-reanimated 4.2.x, react-native-worklets
0.7.x, react-native-bootsplash 7.x and expo 55; keep develop's newer crypto
native deps (piratechain, zcash, zano). Port the native iOS (Expo new-arch
AppDelegate, Info.plist) and Android (newArchEnabled, gradle, MainActivity/
MainApplication) changes, drop the obsolete r3-hack Reanimated-3 Android
workaround in favor of Reanimated 4 under the new architecture, and remove
the no-longer-needed react-native 0.79 patch.
Add a testID to the GettingStarted scene's sign-in link so the RN 0.83
upgrade verification flow can reach the login screen by selector.
@j0ntz j0ntz force-pushed the jon/upgrade-latest-rn branch from 9ae00f3 to 39b453e Compare June 23, 2026 06:12
The Sentry-integrated 'Bundle React Native code and images' build phase
passes a multi-word command (/bin/sh sentry-xcode.sh react-native-xcode.sh)
to react-native's with-environment.sh, which RN 0.83 executes as a single
quoted token ("$1"). That treats the whole command as one nonexistent
path and fails the build with 'No such file or directory'.

Patch with-environment.sh to eval its argument, restoring the multi-word
execution the Sentry wrapper relies on.
@j0ntz

j0ntz commented Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

📸 Test evidence: iOS new-arch build runs (RN 0.83.2)

agent proof 1215939017452147 01 walletlist newarch

agent proof 1215939017452147 01 walletlist newarch

agent proof 1215939017452147 02 buy 500 quote

agent proof 1215939017452147 02 buy 500 quote

Captured by the agent's in-app test run (build-and-test).

Bump react-native-reanimated 4.2.1 to 4.5.0 and react-native-worklets
0.7.2 to 0.10.0 (its required peer). Adapt to the 4.5 type API: the
layout-animation builder classes became generic, so EdgeAnim types
entering/exiting/layout at the BaseAnimationBuilder base; useAnimatedStyle
now returns an opaque AnimatedStyleHandle, so the styled HOC and
SceneWrapper accept the exported AnimatedStyle type. Regenerate the
createAnimatedComponent return-type patch for 4.5.0.

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 1f9665c. Configure here.

* From https://reactnative.dev/docs/0.79/linking?ios-language=swift#enabling-deep-links
*/
func application(
override func application(

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

iOS URL handlers skip ExpoAppDelegate

Medium Severity

After switching AppDelegate to subclass ExpoAppDelegate, the application(_:open:options:) and application(_:continue:restorationHandler:) overrides still return only RCTLinkingManager results and never forward to super. The base ExpoAppDelegate may handle URLs for Expo modules; skipping super can drop those handlers while deep linking still works for React Native paths alone.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 1f9665c. Configure here.

)

return true
return super.application(application, didFinishLaunchingWithOptions: launchOptions)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cold-start shortcut may fire twice

Medium Severity

On cold launch, the app still assigns ExpoQuickActions.initialAction from launchOptions using logic written for a non-ExpoAppDelegate delegate, then calls super.application(_:didFinishLaunchingWithOptions:). With an ExpoAppDelegate, Expo’s lifecycle may also deliver the same home-screen shortcut, so useQuickActionCallback could run twice and open the shortcut URL twice.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 1f9665c. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant