hotfix to add babel runtime to our dependencies #176
Conversation
|
CodeAnt AI is reviewing your PR. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
Walkthroughpackage.json had several dependency entries removed: Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
🔇 Additional comments (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR Compliance Guide 🔍Below is a summary of compliance checks for this PR:
Compliance status legend🟢 - Fully Compliant🟡 - Partial Compliant 🔴 - Not Compliant ⚪ - Requires Further Human Verification 🏷️ - Compliance label |
|||||||||||||||||||||||
|
PR Summary: Add @babel/runtime to runtime dependencies so consumers get the Babel helpers at install.
|
PR Code Suggestions ✨Explore these optional code suggestions:
|
|||||||||
codeant-ai
bot
added
the
size:XS
|
CodeAnt AI finished reviewing your PR. |
![pantoaibot[bot]](https://avatars.githubusercontent.com/in/934356?s=60&v=4){kind=small}
package.json
Outdated
| "url": "https://github.com/Usercentrics/react-native-sdk/issues" | ||
| }, | ||
| "dependencies": { | ||
| "@babel/runtime": "^7.25.3", |
There was a problem hiding this comment.
[REFACTORING] You moved @babel/runtime from devDependencies into dependencies (line 95). This is often the right approach for libraries that import helpers from '@babel/runtime' at runtime, but please verify that your published build actually requires the runtime (i.e. compiled output imports '@babel/runtime'). If you intend to ship helpers in the compiled output instead, consider configuring Babel to inline helpers (avoid @babel/runtime) or explicitly add @babel/plugin-transform-runtime and keep @babel/runtime as a dependency. Actionable steps: (1) Inspect compiled files in lib/ to confirm imports to '@babel/runtime'. (2) If present and desired, keep this change; otherwise adjust Babel configuration to avoid runtime imports.
|
Reviewed up to commit:c122a26a34f775132c9fad477f8cf8a33e9d4f50 Additional SuggestionOthers- Security/compatibility: after introducing @babel/runtime as a runtime dependency, run 'yarn/npm audit' and Upgrade to the latest patch/minor release for @babel/runtime if vulnerabilities are reported. Also run the full test suite and smoke tests on Android/iOS (Hermes) to ensure the runtime change doesn't break consumers. - Version alignment: other package.json files in the repo (example/sample) reference different @babel/runtime versions. This can cause multiple copies of @babel/runtime to be installed across workspaces/consumers and increase bundle size or cause inconsistent behavior. Recommended actions: (1) Bump @babel/runtime to a consistent, up-to-date patch version across all package.json files. (2) Add a resolutions entry (or use your monorepo package manager equivalent) to force a single @babel/runtime version during installs. (3) Run yarn/npm install to update the lockfile and run Metro/Hermes builds to verify no duplicate runtime copies are bundled.{
"devDependencies": {
"@babel/runtime": "^7.25.3"
},
"resolutions": {
"@babel/runtime": "^7.25.3"
}
} |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
package.json(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: test-android
- GitHub Check: test-ios
🔇 Additional comments (1)
package.json (1)
94-102: Correct placement: @babel/runtime should be in dependencies, not devDependencies.This is the right fix. For a published React Native SDK,
@babel/runtimemust be independenciessince it's required at runtime when the package's transpiled code executes in end-user applications. Keeping it only indevDependencieswould cause runtime errors in consuming projects.
package.json
Outdated
| "url": "https://github.com/Usercentrics/react-native-sdk/issues" | ||
| }, | ||
| "dependencies": { | ||
| "@babel/runtime": "^7.25.3", |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
@babel/runtime 7.25.3 security vulnerabilities CVE
💡 Result:
Yes — @babel/runtime 7.25.3 is affected by CVE-2025-27789 (a ReDoS / inefficient regular-expression complexity issue). The flaw affects @babel/runtime versions < 7.26.10; upgrade to >= 7.26.10 (and recompile your code) to remediate. [1][2][3]
Sources:
- Armis CVE entry for CVE-2025-27789. [1]
- ResolvedSecurity summary (affected versions include @babel/runtime < 7.26.10). [2]
- IBM security bulletin referencing CVE-2025-27789 and the fix requirement (upgrade and recompile). [3]
🌐 Web query:
@babel/runtime version 7.25.3 latest stable release npm
💡 Result:
No — @babel/runtime@7.25.3 is not the latest. The current latest stable on npm is 7.28.4 (published Dec 4, 2025). [1][2]
Sources:
- npm package page for @babel/runtime (version listing). [1]
- Release history for @babel/runtime. [2]
Upgrade @babel/runtime to at least 7.26.10 to fix CVE-2025-27789.
Version 7.25.3 is affected by CVE-2025-27789 (ReDoS vulnerability). Versions below 7.26.10 are vulnerable. Upgrade to 7.26.10 or later (latest is 7.28.4) and recompile.
🤖 Prompt for AI Agents
In package.json around line 95, the @babel/runtime entry is pinned to "7.25.3"
which is vulnerable to CVE-2025-27789; update the version string to at least
"7.26.10" (preferably the latest stable, e.g. "7.28.4"), then run your package
manager (npm install or yarn install) to update node_modules and the lockfile
(package-lock.json or yarn.lock), recompile/build the project, and run tests and
npm audit to verify the vulnerability is resolved.
|
CodeAnt AI is running Incremental review Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
User description
PR Type
Enhancement
Description
Move
@babel/runtimefrom devDependencies to dependenciesEnsures babel runtime is available in production environments
Diagram Walkthrough
File Walkthrough
package.json
Move @babel/runtime to production dependenciespackage.json
@babel/runtimefrom devDependencies section@babel/runtimeto dependencies sectionCodeAnt-AI Description
Include @babel/runtime in production dependencies
What Changed
Impact
✅ No missing Babel helpers in production✅ Fewer production app crashes on startup✅ Production installs include required runtime💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.