The Wire · Showcase
React Native kills two feature flags as Jest scrubs a supply-chain advisory
By RepoJournal · Filed · About Meta
The overnight shift quietly simplifies React Native's scheduler internals and closes a Jest dependency hole that was poisoning your audit output.
React Native's Pieter De Baets ripped out two mature feature flags in one sweep. `enableSchedulerDelegateInvalidation` [1] gated a defensive `shared_ptr<atomic<bool>>` invalidation token in `Scheduler`, protecting against dangling pointer dereferences when a rendering-update lambda outlived its delegate. With the flag gone, that guard is now unconditional. Alongside it, `enableRuntimeSchedulerQueueClearingOnError` [2] makes queue-clearing-on-error the default path, with one key fix: `updateRendering` no longer routes resize-observer errors through `handleTaskError`, which would wrongly clear the queues. Near-identical cleanup landed in React core, where a custom `toThrow` matcher that rewrote legacy V8 error messages [3] was removed, since the repo runs only Node 20 and 24, which always produce the modern format. On the DOM side, React corrects a listener identity bug [4] so omitted Fragment event listener options are treated exactly like `capture: false`, fixing a case where a listener added without options couldn't be removed with an explicit capture flag. For TypeScript consumers of React Native, `codegenNativeComponent`'s return type becomes nameable [5] because the `NativeComponentType` alias is now exported, ending the pain of emitting unresolvable declaration files. Meanwhile, in Jest, a dependency bump to glob v13 [6] pulls `minimatch@10` and `brace-expansion@5.0.9`, moving past the GHSA-mh99-v99m-4gvg advisory that flagged `brace-expansion@2.1.2`. As the PR puts it: the advisory "puts the advisory in your audit output even though nothing here calls the affected code path." That's a worthwhile cleanup for anyone running `npm audit`.
One email a day. Unsubscribe in one click.
Keep up with Meta in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Pull the latest react-native main to benefit from simplified scheduler behavior and remove the feature flags from your configs facebook/react-native [monitor]
- → Upgrade jest to a version that includes glob v13 to clear the brace-expansion advisory from your audit output facebook/jest [plan]
- → Watch the react-native 0.87.1 changelog PR for a stable release that includes these fixes facebook/react-native [monitor]
References
- [1] Remove enableSchedulerDelegateInvalidation feature flag and guard (#58138) facebook/react-native
- [2] Remove enableRuntimeSchedulerQueueClearingOnError feature flag (#58132) facebook/react-native
- [3] [test] Remove the custom `toThrow` override for legacy V8 error messages (#37384) facebook/react
- [4] [DOM] Treat omitted Fragment Event listener options same as `capture: false` (#37251) facebook/react
- [5] fix: make `codegenNativeComponent`'s return type nameable by consumers (#58102) facebook/react-native
- [6] chore(deps): update glob to v13 ↗ facebook/jest
