$ the-wire · showcase
REACT NATIVE PATCHES BABEL VULNERABILITY, AXES HERMES LEGACY CODE
By RepoJournal · Filed · About Meta · Composed from the cited sources · methodology
2 people shipped this
React Native shipped a critical Babel fix overnight while gutting three releases worth of dead Hermes infrastructure code.
A HIGH severity vulnerability in @babel/plugin-transform-modules-systemjs [1] forced React Native's hand—versions 7.12.0 through 7.29.3 are exploitable, and the repo was resolving an unpatched 7.25.9. The team added a Yarn resolution to force 7.29.4, the first safe version. This isn't optional. Meanwhile, the Hermes cleanup [2][3] removes two major feature flags (HERMES_V1_ENABLED and the hermesV1Enabled Gradle property) that have been dead weight for releases now. Teams running apps with custom Hermes builds need to know the compile definitions have changed. On the Jest side, the runtime gained native ESM fallback detection [4][5]—if a .js file contains import/export syntax, Jest now uses native Node ESM instead of CommonJS transformation, solving a class of weird edge cases. The test docs finally caught up to the code [6], documenting the long-hidden expect.getState() and expect.setState() APIs that developers have been cargo-culting for years. And React Native fixed a silent error message bug [7] where invariant failures in renderApplication dropped the actual rootTag value instead of showing it.
Action items
- → Force @babel/plugin-transform-modules-systemjs to ^7.29.4 immediately via Yarn resolution facebook/react-native [immediate]
- → If you maintain custom Hermes C++ integrations, remove all HERMES_V1_ENABLED guards before next release facebook/react-native [plan]
- → Update Jest runtime if you have .js files with ESM syntax to take advantage of native fallback facebook/jest [monitor]
References
- [1] Bump @babel/plugin-transform-modules-systemjs to fix CVE-2026-44728 (#56775) ↗ facebook/react-native
- [2] Remove legacy Hermes C++ code and HERMES_V1_ENABLED compile definition (#56731) ↗ facebook/react-native
- [3] Remove hermesV1Enabled Gradle property and simplify Hermes version resolution (#56733) ↗ facebook/react-native
- [4] fix(jest-runtime): fall back to native ESM when a .js file contains ESM syntax ↗ facebook/jest
- [5] fix(jest-runtime): fall back to native ESM when a .js file contains ESM syntax (#16152) ↗ facebook/jest
- [6] docs: document expect.getState() and expect.setState() API ↗ facebook/jest
- [7] - Fix missing format specifier in renderApplication invariant (#56329) facebook/react-native ↗
