[0.81] Upgrade to glob@^13.0.0 and adjust usage
#54669
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
meta-cla
bot
added
the
CLA Signed
This was referenced Nov 26, 2025
Contributor
Author
|
Succeeded by: #54737 |
meta-codesync bot
pushed a commit
that referenced
this pull request
Dec 3, 2025
Summary: This replaces `glob@^7.0.0` with `tinyglobby@^0.2.15`. `glob@7` has been deprecated for a while and some versions after had security notices released for them. The plan is to backport this PR to `0.81.x` and onwards. > [!NOTE] > This is a stopgap solution until `fs.glob` becomes generally available with the EOL of Node v20 Succeeds: - #54669 - #48875 ## Changelog: [GENERAL] [SECURITY] - Replace `glob@^7.0.0` with `tinyglobby@^0.2.15` Pull Request resolved: #54737 Test Plan: - Ran all modified commands manually and `pod install in `rn-tester` - NOTE: `ios-prebuild`-related scripts haven't been run manually yet Reviewed By: robhogan Differential Revision: D88069145 Pulled By: huntie fbshipit-source-id: 0c455342a4c6d1d6605fd09fe47b418e5d751491
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary:
This upgrades
react-nativefromglob@^7.0.0, which has been deprecated for a while, past some versions with security notices, to the latest version,glob@^13.0.0. The flow typings are only partially added and skip over some unused minipass and path-scurry functionality.Note
This is a stopgap solution until
fs.globbecomes generally available with the EOL of Node v20. Hence, this PR targets a specific release branch. Previous PR, for context, was: #48875Changelog:
[GENERAL] [CHANGED] - Upgrade from deprecated
glob@^7.0.0to supportedglob@^13.0.0Test Plan:
Changes in
globare captured here: https://github.com/isaacs/node-glob/blob/v13.0.0/changelog.mdRelevant breaking changes are:
followandnodirare both set'.'instead of the empty string''when the current working directory is returned as a match.{ absolute:false }option to explicitly always return relative paths. An unsetabsolutesetting will still return absolute or relative paths based on whether the pattern is absolute.rootoption, albeit with slightly different semantics than in v8 and before./will still be restricted to matching directories, but will not have a/appended in the resultscwdbehavior so it is far less magical, and relies less on platform-specific absolute path representations.windowsPathsNoEscapeoption\is now only used as an escape character, and never as a path separator in glob patterns, so that Windows users have a way to match against filenames containing literal glob pattern characters./as path separators on Windows, as they cannot contain glob patterns anyway, and are often supplied bypath.resolve()and other methods that will use\path separators by default.