chore(deps): bump lerna to ^9.0.7 to resolve remaining dev-tooling advisories#6499
Open
antonis wants to merge 3 commits into
Open
chore(deps): bump lerna to ^9.0.7 to resolve remaining dev-tooling advisories#6499antonis wants to merge 3 commits into
antonis wants to merge 3 commits into
Conversation
…isories Upgrades lerna 8.1.8 -> 9.0.7, which brings patched transitive @octokit/*, sigstore, @sigstore/core and uuid. lerna 9 pulls nx 22, which re-introduces a brace-expansion v5 DoS advisory; that is pinned to ^5.0.7 via resolutions. Removes two now-stale lerna@8.1.8 minimatch resolutions. All advisories are dev/build tooling only; the shipped @sentry/react-native runtime tree is unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
Semver Impact of This PR⚪ None (no version bump detected) 📋 Changelog PreviewThis is how your changes will appear in the changelog.
🤖 This preview updates automatically when you update the PR. |
Removes 5 scoped minimatch/js-yaml resolutions whose parent packages (front-matter@4.0.2, multimatch@5.0.0, node-dir@0.1.17, ignore-walk@6.0.5, nx@19.6.4) are no longer in the dependency tree after lerna 8 -> 9. Verified inert: yarn.lock is byte-identical after removal and yarn npm audit --recursive still reports 0 advisories. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
iOS (legacy) Performance metrics 🚀
|
| Revision | Plain | With Sentry | Diff |
|---|---|---|---|
| 7ff4d0f+dirty | 3838.29 ms | 1225.13 ms | -2613.16 ms |
| 7ac3378+dirty | 1213.37 ms | 1218.15 ms | 4.78 ms |
| ecf47a2+dirty | 3835.20 ms | 1222.43 ms | -2612.77 ms |
| e763471+dirty | 3841.16 ms | 1218.06 ms | -2623.09 ms |
| a0d8cf8+dirty | 3842.33 ms | 1212.40 ms | -2629.93 ms |
| 5748023+dirty | 3840.49 ms | 1227.43 ms | -2613.05 ms |
| c004dae+dirty | 3850.32 ms | 1227.79 ms | -2622.53 ms |
| 3ce5254+dirty | 1219.93 ms | 1221.90 ms | 1.96 ms |
| 37a2091+dirty | 3821.77 ms | 1212.34 ms | -2609.43 ms |
| 5ca03f9+dirty | 3844.55 ms | 1218.36 ms | -2626.19 ms |
App size
| Revision | Plain | With Sentry | Diff |
|---|---|---|---|
| 7ff4d0f+dirty | 5.15 MiB | 6.70 MiB | 1.55 MiB |
| 7ac3378+dirty | 3.38 MiB | 4.76 MiB | 1.38 MiB |
| ecf47a2+dirty | 4.98 MiB | 6.46 MiB | 1.49 MiB |
| e763471+dirty | 4.98 MiB | 6.51 MiB | 1.53 MiB |
| a0d8cf8+dirty | 5.15 MiB | 6.67 MiB | 1.51 MiB |
| 5748023+dirty | 5.15 MiB | 6.68 MiB | 1.53 MiB |
| c004dae+dirty | 5.15 MiB | 6.67 MiB | 1.51 MiB |
| 3ce5254+dirty | 3.38 MiB | 4.76 MiB | 1.38 MiB |
| 37a2091+dirty | 5.15 MiB | 6.70 MiB | 1.54 MiB |
| 5ca03f9+dirty | 4.98 MiB | 6.53 MiB | 1.55 MiB |
antonis
marked this pull request as ready for review
July 22, 2026 11:37
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit adad396. Configure here.
| "downlevel-dts": "^0.11.0", | ||
| "google-java-format": "^1.4.0", | ||
| "lerna": "^8.1.8", | ||
| "lerna": "^9.0.7", |
There was a problem hiding this comment.
Lerna 9 drops Node 18
High Severity
Flagged because the dependency-update review guidelines call out new requirements from major bumps. lerna ^9.0.7 (and transitive nx 22) require Node ^20.19.0 || ^22.12.0 || >=24.0.0, but Volta still pins 18.20.8 and CI workflows still use node-version: 18. Build, test, and lerna version in release therefore run on an unsupported Node.
Additional Locations (1)
Triggered by project rule: PR Review Guidelines for Cursor Bot
Reviewed by Cursor Bugbot for commit adad396. Configure here.
Contributor
Author
There was a problem hiding this comment.
Marking as blocked for now since this is a valid concern that needs to be investigated in detail. All the issues that this PR fixes are dev only and do not affect production anyway.
Contributor
Author
There was a problem hiding this comment.
Since the CI is green and this is a not shipped dev change we can proceed with that and consider upgrading along with a future lerna bump that breaks Node 18.
antonis
marked this pull request as draft
July 22, 2026 11:42
Contributor
iOS (new) Performance metrics 🚀
|
| Revision | Plain | With Sentry | Diff |
|---|---|---|---|
| ae37560+dirty | 3840.10 ms | 1217.89 ms | -2622.21 ms |
| e763471+dirty | 3826.10 ms | 1221.52 ms | -2604.58 ms |
| 0b1b5e3+dirty | 3820.72 ms | 1207.94 ms | -2612.78 ms |
| 5ca03f9+dirty | 3873.76 ms | 1236.26 ms | -2637.51 ms |
| acd838e+dirty | 3835.94 ms | 1215.87 ms | -2620.07 ms |
| 5789645+dirty | 3841.36 ms | 1214.81 ms | -2626.55 ms |
| 61cc206+dirty | 3822.60 ms | 1206.17 ms | -2616.43 ms |
| a2585ce+dirty | 3837.98 ms | 1214.20 ms | -2623.77 ms |
| bc8f61e+dirty | 3849.87 ms | 1221.19 ms | -2628.68 ms |
| 5b7e8a7+dirty | 3855.46 ms | 1234.47 ms | -2620.99 ms |
App size
| Revision | Plain | With Sentry | Diff |
|---|---|---|---|
| ae37560+dirty | 5.15 MiB | 6.70 MiB | 1.54 MiB |
| e763471+dirty | 4.98 MiB | 6.51 MiB | 1.53 MiB |
| 0b1b5e3+dirty | 5.15 MiB | 6.70 MiB | 1.54 MiB |
| 5ca03f9+dirty | 4.98 MiB | 6.53 MiB | 1.55 MiB |
| acd838e+dirty | 5.15 MiB | 6.70 MiB | 1.55 MiB |
| 5789645+dirty | 4.98 MiB | 6.50 MiB | 1.52 MiB |
| 61cc206+dirty | 4.98 MiB | 6.55 MiB | 1.57 MiB |
| a2585ce+dirty | 4.98 MiB | 6.55 MiB | 1.57 MiB |
| bc8f61e+dirty | 4.98 MiB | 6.47 MiB | 1.49 MiB |
| 5b7e8a7+dirty | 5.15 MiB | 6.70 MiB | 1.54 MiB |
antonis
added
Blocked
and removed
ready-to-merge
Contributor
Android (legacy) Performance metrics 🚀
|
| Revision | Plain | With Sentry | Diff |
|---|---|---|---|
| a5d243c+dirty | 424.52 ms | 485.18 ms | 60.66 ms |
| e5bb5f6+dirty | 430.09 ms | 459.96 ms | 29.87 ms |
| 7ac3378+dirty | 404.78 ms | 439.84 ms | 35.06 ms |
| 5789645+dirty | 426.82 ms | 495.42 ms | 68.60 ms |
| 853723c+dirty | 405.54 ms | 440.08 ms | 34.54 ms |
| 61cc206+dirty | 522.33 ms | 553.98 ms | 31.65 ms |
| 44c8b3f+dirty | 414.20 ms | 457.28 ms | 43.08 ms |
| 68ae91b+dirty | 416.44 ms | 477.56 ms | 61.12 ms |
| 7a89652+dirty | 537.76 ms | 567.84 ms | 30.08 ms |
| b0d3373+dirty | 557.66 ms | 579.42 ms | 21.76 ms |
App size
| Revision | Plain | With Sentry | Diff |
|---|---|---|---|
| a5d243c+dirty | 48.30 MiB | 53.54 MiB | 5.23 MiB |
| e5bb5f6+dirty | 49.74 MiB | 55.09 MiB | 5.34 MiB |
| 7ac3378+dirty | 43.75 MiB | 48.13 MiB | 4.37 MiB |
| 5789645+dirty | 49.74 MiB | 54.85 MiB | 5.11 MiB |
| 853723c+dirty | 48.30 MiB | 53.58 MiB | 5.28 MiB |
| 61cc206+dirty | 49.74 MiB | 55.36 MiB | 5.62 MiB |
| 44c8b3f+dirty | 48.30 MiB | 53.46 MiB | 5.15 MiB |
| 68ae91b+dirty | 49.74 MiB | 54.79 MiB | 5.05 MiB |
| 7a89652+dirty | 48.30 MiB | 53.60 MiB | 5.30 MiB |
| b0d3373+dirty | 48.30 MiB | 53.58 MiB | 5.28 MiB |
Contributor
Android (new) Performance metrics 🚀
|
| Revision | Plain | With Sentry | Diff |
|---|---|---|---|
| 04207c4+dirty | 395.40 ms | 456.55 ms | 61.15 ms |
| e5bb5f6+dirty | 438.85 ms | 466.33 ms | 27.48 ms |
| 3d377b5+dirty | 425.38 ms | 440.67 ms | 15.30 ms |
| 5789645+dirty | 502.66 ms | 594.19 ms | 91.53 ms |
| 4953e94+dirty | 398.80 ms | 431.81 ms | 33.01 ms |
| 7d6fd3a+dirty | 435.06 ms | 458.78 ms | 23.72 ms |
| 7ff4d0f+dirty | 403.38 ms | 427.06 ms | 23.68 ms |
| 61cc206+dirty | 417.44 ms | 466.29 ms | 48.85 ms |
| 853723c+dirty | 415.82 ms | 460.94 ms | 45.12 ms |
| 27d9693+dirty | 438.63 ms | 514.08 ms | 75.46 ms |
App size
| Revision | Plain | With Sentry | Diff |
|---|---|---|---|
| 04207c4+dirty | 43.94 MiB | 48.98 MiB | 5.04 MiB |
| e5bb5f6+dirty | 49.74 MiB | 55.09 MiB | 5.34 MiB |
| 3d377b5+dirty | 43.94 MiB | 49.00 MiB | 5.06 MiB |
| 5789645+dirty | 49.74 MiB | 54.85 MiB | 5.11 MiB |
| 4953e94+dirty | 43.94 MiB | 48.94 MiB | 5.00 MiB |
| 7d6fd3a+dirty | 43.94 MiB | 49.00 MiB | 5.06 MiB |
| 7ff4d0f+dirty | 48.30 MiB | 53.60 MiB | 5.30 MiB |
| 61cc206+dirty | 49.74 MiB | 55.36 MiB | 5.62 MiB |
| 853723c+dirty | 48.30 MiB | 53.58 MiB | 5.28 MiB |
| 27d9693+dirty | 49.74 MiB | 55.09 MiB | 5.34 MiB |
antonis
marked this pull request as ready for review
July 24, 2026 10:20
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📢 Type of change
📜 Description
Upgrades
lerna^8.1.8→^9.0.7to clear the remaining transitive security advisories that were bundled inside lerna 8's publish/GitHub-API internals.Changes:
lerna: ^8.1.8 → ^9.0.7(dev dependency).brace-expansionv5 to^5.0.7viaresolutions— lerna 9 pulls nx 22, which would otherwise re-introduce abrace-expansionDoS (see below).lerna@npm:8.1.8/@lerna/create@npm:8.1.8(those packages no longer exist in lerna 9).front-matter@4.0.2/js-yaml,multimatch@5.0.0/minimatch,node-dir@0.1.17/minimatch,ignore-walk@6.0.5/minimatch,nx@19.6.4/minimatch. Their parent packages are no longer in the tree after lerna 8 → 9; verified inert (yarn.lock byte-identical after removal, audit still 0).All affected packages are dev/build tooling only — none are part of the shipped
@sentry/react-nativeruntime, whose production dependency tree audits clean before and after this change.💡 Motivation and Context
Follow-up to the earlier dev-only advisory fixes (#6486, #6487, #6488, #6489). After those, the remaining open Dependabot alerts were all bundled inside
lerna@8.1.8. Bumping lerna to 9 resolves them all.Advisories resolved by this PR:
sigstore— GHSA-52v5-jr5w-gjxr (High)@sigstore/core— GHSA-jfc7-64v2-mr8c (Moderate)@octokit/plugin-paginate-rest— GHSA-h5c3-5r3r-rr8q (Moderate)@octokit/request— GHSA-rmvr-2pp2-xj38 (Moderate)@octokit/request-error— GHSA-xx4v-prfh-6cgc (Moderate)uuid— GHSA-w5hq-g745-h8pq (Moderate)Advisory introduced by nx 22 and pre-emptively pinned here:
brace-expansion(v5,>=3.0.0 <5.0.7) — GHSA-3jxr-9vmj-r5cp (High) → pinned to^5.0.7.After this PR,
yarn npm audit --recursivereports 0 real advisories (excluding unrelated deprecation notices).💚 How did you test it?
Run locally on this branch:
yarn install --immutable— passes (lockfile in sync, no unused-resolution warnings).yarn npm audit --recursive— 0 real advisories.yarn build— ✅ Successfully ranbuildfor all projects.yarn test— ✅ Successfully rantestfor all projects (all suites passing).📝 Checklist
sendDefaultPIIis enabled.🔮 Next steps
Confirm the
lerna publish/ release workflow still works on lerna 9 before merging.