Bump postcss and expo by dependabot[bot] · Pull Request #6103 · EdgeApp/edge-react-gui

dependabot · 2026-07-24T19:58:25Z

Bumps postcss to 8.5.25 and updates ancestor dependency expo. These dependencies need to be updated together.

Updates postcss from 8.4.49 to 8.5.25

Release notes

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

... (truncated)

Commits

08c989c Release 8.5.25 version
24f6814 Fix 8.5.17 visitor regression
f2fa53f Add supply chain security requirement to PostCSS plugin guide
10edf0b fix: return empty array for empty string in list.split (#2121)
0ebe8ad Release 8.5.24 version
73218c6 Update dependencies
9a114f6 Preserve the BOM when stringifying (#2119)
9069261 Fix types check
eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates expo from 53.0.20 to 57.0.9

Changelog

Sourced from expo's changelog.

57.0.9 - 2026-07-29

This version does not introduce any user-facing changes.

57.0.8 - 2026-07-22

🐛 Bug fixes

[Android] Fixed expo-fetch race condition causing out-of-order delivery of initial chunks (#42161 by @matthieugicquel)

57.0.7 - 2026-07-17

🐛 Bug fixes

Fix import.meta.url being null on web when read after the bundle's synchronous execution (from effects, async code, or dynamic imports). (#47802 by @zoontek)

57.0.6 - 2026-07-15

This version does not introduce any user-facing changes.

57.0.5 - 2026-07-15

🐛 Bug fixes

[iOS] Pass the React runtime scheduler to ExpoModulesCore through a weak handle, so dispatching onto the JS thread during a reload no longer risks calling into a scheduler the React instance already destroyed. (#47492 by @tsapeta)

Fix Response.blob() in expo/fetch throwing when the global Blob is react-native's implementation. (#47538 by @kudo)

57.0.4 - 2026-07-07

This version does not introduce any user-facing changes.

57.0.3 - 2026-07-07

This version does not introduce any user-facing changes.

57.0.2 - 2026-07-03

This version does not introduce any user-facing changes.

57.0.1 - 2026-06-30

This version does not introduce any user-facing changes.

57.0.0 - 2026-06-30

This version does not introduce any user-facing changes.

57.0.0-preview.1 - 2026-06-27

This version does not introduce any user-facing changes.

... (truncated)

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by alanhughes, a new releaser for expo since your current version.

socket-security · 2026-07-24T19:59:41Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	expo@53.0.20 ⏵ 57.0.9	^-6		⁺²³

View full report

socket-security · 2026-07-24T19:59:43Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@react-native/debugger-frontend` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/expo@57.0.9` → `npm/@react-native/debugger-frontend@0.86.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@react-native/debugger-frontend@0.86.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@react-native/debugger-frontend` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/expo@57.0.9` → `npm/@react-native/debugger-frontend@0.86.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@react-native/debugger-frontend@0.86.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `node-forge` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/expo@57.0.9` → `npm/@walletconnect/web3wallet@1.10.1` → `npm/node-forge@1.4.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/node-forge@1.4.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `fetch-nodeshim` Location: Package overview From: package-lock.json → `npm/expo@57.0.9` → `npm/fetch-nodeshim@0.4.10` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/fetch-nodeshim@0.4.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit db5a9e9. Configure here.}

cursor · 2026-07-27T23:06:55Z

    "edge-login-ui-rn": "^3.37.0",
    "ethers": "^5.7.2",
-    "expo": "^53.0.0",
+    "expo": "^57.0.8",


Expo 57 mismatches React Native

High Severity

Raising expo to ^57.0.8 while react-native remains 0.79.2 pairs an SDK built for React Native 0.86 with an older runtime and Metro stack. Native modules, autolinking, and bundling can fail at build time or misbehave at runtime after this dependency-only bump.

^{Reviewed by Cursor Bugbot for commit db5a9e9. Configure here.}

Bumps [postcss](https://github.com/postcss/postcss) to 8.5.25 and updates ancestor dependency [expo](https://github.com/expo/expo/tree/HEAD/packages/expo). These dependencies need to be updated together. Updates `postcss` from 8.4.49 to 8.5.25 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.49...8.5.25) Updates `expo` from 53.0.20 to 57.0.9 - [Changelog](https://github.com/expo/expo/blob/main/packages/expo/CHANGELOG.md) - [Commits](https://github.com/expo/expo/commits/HEAD/packages/expo) --- updated-dependencies: - dependency-name: expo dependency-version: 57.0.8 dependency-type: direct:production - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

cursor · 2026-08-02T17:57:43Z

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 24, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-96ce8d1450 branch 3 times, most recently from 8d233d4 to db5a9e9 Compare July 27, 2026 23:05

cursor Bot reviewed Jul 27, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-96ce8d1450 branch from db5a9e9 to e79bba0 Compare August 2, 2026 17:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump postcss and expo - #6103

Bump postcss and expo#6103
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/multi-96ce8d1450

dependabot Bot commented on behalf of github Jul 24, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jul 27, 2026

Uh oh!

cursor Bot commented Aug 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

57.0.9 - 2026-07-29

57.0.8 - 2026-07-22

🐛 Bug fixes

57.0.7 - 2026-07-17

🐛 Bug fixes

57.0.6 - 2026-07-15

57.0.5 - 2026-07-15

🐛 Bug fixes

57.0.4 - 2026-07-07

57.0.3 - 2026-07-07

57.0.2 - 2026-07-03

57.0.1 - 2026-06-30

57.0.0 - 2026-06-30

57.0.0-preview.1 - 2026-06-27

Uh oh!

socket-security Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 27, 2026

Choose a reason for hiding this comment

Expo 57 mismatches React Native

Uh oh!

cursor Bot commented Aug 2, 2026

Bugbot is paused — on-demand spend limit reached

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 24, 2026 •

edited

Loading

socket-security Bot commented Jul 24, 2026 •

edited

Loading

socket-security Bot commented Jul 24, 2026 •

edited

Loading