The Wire · Showcase
REACT NATIVE HARDENS BUILD PIPELINE WHILE FIXING ANDROID TEXT RENDERING
By RepoJournal · Filed · About Meta
React Native shipped critical infrastructure upgrades overnight: OIDC token replacement for npm publishing, AGP v9 adoption across the stack, and a text decoration rendering fix that restores native Android behavior.
The biggest story is npm publishing security [1]. React Native replaced long-lived `GHA_NPM_TOKEN` automation tokens with OIDC Trusted Publishing via a reusable workflow, eliminating a critical attack surface for package compromises. Alongside that, the team adopted Android Gradle Plugin v9 repository-wide [2], deprecating legacy APIs and modernizing the entire build graph. That same modernization work includes removing the folly::Endian dependency from JSIndexedRAMBundle [4], cutting unnecessary build overhead by inlining a simple little-endian decoder. On the stability front, a recent change that switched Android text decoration to custom canvas drawing inadvertently increased stroke thickness by 1.5dp [3]. The fix removes the minimum thickness enforcement, restoring native Android behavior. A minor CI fix landed for gradle.properties templating [5], but it's a cleanup that unblocks template testing.
Action items
- → Review OIDC Trusted Publishing integration if you maintain a React Native fork or publish packages from GHA facebook/react-native [plan]
- → Plan AGP v9 upgrade for your React Native builds; legacy APIs are now deprecated facebook/react-native [plan]
- → Verify text decoration rendering on Android after the stroke thickness fix facebook/react-native [monitor]
References
- [1] Migrate npm publish to OIDC Trusted Publishing via a reusable workflow (#57099) facebook/react-native
- [2] feat: adopt AGP v9 (#57038) facebook/react-native
- [3] Fix text decoration line thickness regression on Android (#57111) facebook/react-native
- [4] Remove folly::Endian::little from JSIndexedRAMBundle (#57109) facebook/react-native
- [5] fix: add line break to gradle.properties for template testing (#57107) facebook/react-native
FAQ
- What changed in Meta on June 9, 2026?
- React Native shipped critical infrastructure upgrades overnight: OIDC token replacement for npm publishing, AGP v9 adoption across the stack, and a text decoration rendering fix that restores native Android behavior.
- What should Meta teams do about it?
- Review OIDC Trusted Publishing integration if you maintain a React Native fork or publish packages from GHA • Plan AGP v9 upgrade for your React Native builds; legacy APIs are now deprecated • Verify text decoration rendering on Android after the stroke thickness fix
- Which Meta repositories shipped on June 9, 2026?
- facebook/react-native