Skip to content

build(deps): Bump postcss, expo and @reactvision/react-viro - #27

Open
dependabot[bot] wants to merge 1 commit into
feature/ui-refreshfrom
dependabot/npm_and_yarn/multi-1d0d18e6fd
Open

build(deps): Bump postcss, expo and @reactvision/react-viro#27
dependabot[bot] wants to merge 1 commit into
feature/ui-refreshfrom
dependabot/npm_and_yarn/multi-1d0d18e6fd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 31, 2026

Copy link
Copy Markdown

Bumps postcss to 8.5.25 and updates ancestor dependencies postcss, expo and @reactvision/react-viro. These dependencies need to be updated together.

Updates postcss from 8.4.49 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates expo from 53.0.27 to 57.0.9

Changelog

Sourced from expo's changelog.

Changelog

This is the log of notable changes to the Expo client that are developer-facing. Package-specific changes not released in any SDK will be added here just before the release. Until then, you can find them in changelogs of the individual packages (see packages directory).

Unpublished

📚 3rd party library updates

🛠 Breaking changes

🎉 New features

🐛 Bug fixes

57.0.0 — 2026-07-08

🛠 Breaking changes

  • @expo/ui
  • expo-modules-jsi
    • [iOS] JavaScriptError is now a copyable class conforming to Error (was a non-copyable struct), and JavaScriptValue no longer conforms to Error. (#47154 by @​tsapeta)
  • expo-font
    • [web] Removed Server.resetServerContext(). Server-side font state is now scoped per-render via AsyncLocalStorage. (#46669 by @​hassankhan)
  • @expo/cli
    • Make expo prebuild clear and regenerate the native folders by default. Pass --no-clean to apply changes to the existing folders instead. (#47209 by @​alanjhughes)

🎉 New features

  • Initial release of @expo/require-utils 🥳
  • pod-install
  • @expo/ui
    • [iOS] Added the SwiftUI accessibilityHidden modifier to hide decorative views from VoiceOver and other assistive technologies during element traversal. (#46579 by @​ramonclaudio)
    • [iOS] Added the SwiftUI accessibilityIdentifier modifier to set a stable identifier for UI testing tools such as XCUITest. (#46556 by @​ramonclaudio)
    • [iOS] Added the SwiftUI dynamicTypeSize modifier to set or constrain the Dynamic Type size within a view. Accepts a single size or a { min, max } range, and cascades from <Host> to bound how far text scales at the largest accessibility sizes. (#46540 by @​ramonclaudio)
    • [iOS] Added children prop to Label component, allowing custom title views (e.g. a VStack with title and subtitle) while preserving native icon spacing and Dynamic Type icon sizing.
    • [iOS] Add buttonBorderShape SwiftUI modifier, which reshapes a styled button (for example a glass button) while preserving its native press effect. (#46348 by @​nishan) (#46348 by @​intergalacticspacehighway)
    • [jetpack-compose] Added NavigationBar and NavigationBarItem components.
    • [iOS] Added the SwiftUI listRowSpacing modifier. (#46417 by @​qiyangdev)
    • [iOS] Added support for custom SF Symbols in the SwiftUI Image component. (#46183 by @​cinques)
    • [swift-ui] Added <DisclosureGroup.Label> for custom label style. (#46288 by @​kudo)
    • [universal] Added <Collapsible.labelStyle> for custom label style. (#46288 by @​kudo)
    • [jetpack-compose] Added dropShadow and innerShadow modifiers. (#46364 by @​duyanhv)
    • [iOS] Added the SwiftUI imageScale modifier to scale SF Symbols within a view relative to the surrounding text (small, medium, large). (#46774 by @​ramonclaudio)
    • [jetpack-compose] Added onGloballyPositioned modifier, which reports a composable's window position and size. (#46744 by @​nishan) (#46744 by @​intergalacticspacehighway)
    • [iOS] Extended the SwiftUI onGeometryChange modifier to also report the view's global position (x/y) alongside its size. (#46744 by @​nishan) (#46744 by @​intergalacticspacehighway)
    • [iOS] Added the SwiftUI minimumScaleFactor modifier to let text shrink down to a given fraction of its size before truncating. (#46740 by @​nishan) (#46740 by @​intergalacticspacehighway)
    • [iOS][android] Added React Compiler-friendly get() / set() accessors to useNativeState, as an alternative to reading and writing .value. (#46690 by @​nishan) (#46692 by @​intergalacticspacehighway)

... (truncated)

Commits

Updates @reactvision/react-viro from 2.43.4 to 2.57.5

Release notes

Sourced from @​reactvision/react-viro's releases.

v2.57.5

Release Notes

v2.57.5

Highlights

Stability / crashes

  • Scene-open freeze fixed (Android). Opening an AR scene with heavier content (3D models / video) could freeze the app for ~5 s (ANR) on some devices. An interim camera-background workaround was replaying pause → resume on the UI thread, which blocked the main thread in GLSurfaceView.onPause() waiting on the GL thread. The workaround was removed now that the renderer handles camera-texture binding natively; the black-passthrough issue it guarded against stays fixed.
  • Animated glTF model crash fixed. Loading an animated model whose rig has a zero-duration animation channel (a single keyframe / all-zero times — legal glTF) crashed with a native SIGSEGV (divide-by-zero → NaN keyframe times → corrupted sort in the renderer's skeletal-animation resampler). Guarded in the renderer.
  • Anchor-retry crash fixed (Android, SIGSEGV). Leaving/switching an AR scene while a node's anchor retry was pending could crash in nativeCreateAnchoredNode; the retry now bails when the parent scene is torn down (plus a native null-ref guard in the renderer).
  • getTransformAsync / getBoundingBoxAsync / getMorphTargets no longer redbox or hang when the node isn't registered yet (a normal mount race hit by onProximity). They now reject with view_not_ready so callers can retry/ignore quietly (iOS + Android).

Features

  • onGaze — eye-gaze hover on Meta Quest Pro. New optional event on every Viro node that fires when the node is hovered by the user's eye-gaze ray (renderer support via XR_EXT_eye_gaze_interaction, Quest Pro). onHover still fires for all input sources; onGaze is eye-gaze-only, and setting it alone enables hover on the node. No-op on headsets without eye tracking (Quest 2 / 3 / 3S).
  • Free-tier watermark now burned into recorded video on Android (previously photo-only), composited natively per frame in the renderer — at parity with iOS.

Media

  • Android media files are now reliably written (API 29+). Screenshots and video recordings were silently failing under scoped storage (raw write to public Pictures/ → EACCES), or landing in app-private storage invisible to the gallery. Media now writes to app-specific storage (always succeeds) and is published to the gallery via MediaStore when saveToCameraRoll is set. Permission gate corrected (RECORD_AUDIO; WRITE_EXTERNAL_STORAGE only on API ≤ 28).

Migration

  • No breaking changes. onGaze is additive; everything else is a bug/stability fix.

v2.57.4

Stability improvements

v2.57.3

Highlights

  • Expo SDK 57 / React Native 0.86 support (viro#492). Widened peerDependencies (expo <58.0.0, react-native <0.87.0) and the build toolchain. RN 0.86 ships no breaking changes, so no native changes were required.
  • frontCameraEnabled (iOS) moved to the optional @reactvision/react-viro-face-tracking package — fixes App Store review 2.5.1. ARKit's front camera uses the TrueDepth API, which Apple statically scans for, so bundling it in core flagged every app — even rear-camera-only ones. Keeping it out of core lets those apps pass review with no configuration. Install the package (and its config plugin) only if you need front-camera AR. Android is unchanged. For a selfie feed without face tracking, use ViroCameraTexture with cameraPosition="front" (AVFoundation, no TrueDepth).
  • Android launch crash fixed (viro#491). Removed the prebuilt libvrapi.so, which was force-loaded on every launch and crashed all apps.
  • ViroVideo lifecycle crash & freeze fixed (viro#478). Two Android fixes: the app no longer crashes on background/foreground transitions with a ViroVideo in the scene (post-teardown ExoPlayer callbacks reaching freed native memory are now guarded), and the app no longer freezes/ANRs when leaving a ViroVideo screen (a per-frame GL-thread query into ExoPlayer that deadlocked against view teardown is now served from a main-thread-refreshed cache — this also smooths playback).
  • ViroARImageMarker crash fixed. Registering a tracking target after the marker mounts no longer throws under the New Architecture; the marker attaches regardless of order.
  • LiDAR depth confidence fixed (iOS). depthConfidence in AR hit-test results now returns a real ARKit confidence (0–1) instead of the raw depth value, so the confidence gate correctly discards low-quality depth hits.
  • Deprecated the Oculus Mobile SDK (VrApi) path. ViroPlatform.OVR_MOBILE / ViroViewOVR are superseded by the OpenXR path (ViroPlatform.QUEST / ViroViewOpenXR), covering all current Meta headsets.

Migration

  • frontCameraEnabled on iOS: install @reactvision/react-viro-face-tracking and add its config plugin, or the prop is a no-op after upgrading. No change on Android or if you don't use it.
  • VrApi: switch ViroPlatform.OVR_MOBILE → ViroPlatform.QUEST. GearVR / Oculus Go are no longer supported.
  • No change for AR, GVR (Cardboard), or existing Quest (OpenXR) apps.

Notes

... (truncated)

Changelog

Sourced from @​reactvision/react-viro's changelog.

v2.57.5 — 26 July 2026

Added

  • onGaze prop for eye-gaze hover on Meta Quest Pro. New optional event on all Viro nodes (onGaze?: (isHovering, position, source) => void) that fires when the node is hovered by the eye-gaze ray specifically, backed by @reactvision/virocore 2.57.5's XR_EXT_eye_gaze_interaction support. onHover still fires for every input source (controllers, hands, eye gaze); onGaze is limited to the eye-gaze source, and setting it alone is enough to enable hover on the node. No-op on devices without eye tracking (Quest 2 / 3 / 3S).

Fixed

  • AR anchor retry no longer crashes when leaving a scene (Android, SIGSEGV). VRTNode's delayed anchor-retry (a 1s main-thread handler, up to 3×) could fire after its parent AR scene had been torn down, calling createAnchoredNode() on a freed native VROARSceneController and crashing (SEGV_MAPERR in nativeCreateAnchoredNode). The retry now bails if the parent scene is gone — checking the scene's teardown flag and zeroed native ref (which covers the dispose-before-flag window) — and VRTARScene cancels pending child anchor retries on teardown. @reactvision/virocore 2.57.5 adds a matching native null-ref guard as defense-in-depth.
  • Screenshots and video recordings are now reliably written on Android (API 29+). Media was written with a raw File into the public Pictures/ directory, which fails with EACCES under scoped storage — so files silently weren't created, or (with saveToCameraRoll off) landed in app-private storage invisible to the gallery while still reporting success. Media now writes to app-specific external storage (always succeeds, no runtime storage permission) and, when saveToCameraRoll is set, is published to the device gallery via MediaStore. The recording permission gate was corrected to request only what's needed (RECORD_AUDIO; WRITE_EXTERNAL_STORAGE only on API ≤ 28) and to stop ignoring the grant result.
  • Free-tier watermark is now burned into recorded video on Android. Screenshots were already watermarked, but video — rendered directly into the encoder's surface — had no per-frame hook, so recordings went out unmarked. The bridge now hands the recorder a watermark bitmap, composited natively per frame by @reactvision/virocore 2.57.5, matching iOS and the Android photo path. Gated on free tier like the other paths.
  • getTransformAsync / getBoundingBoxAsync / getMorphTargets no longer redbox or hang when a node isn't ready. On iOS (VRTNodeModule) and Android (NodeModule) these logged an error and returned without settling the promise when the view tag wasn't a registered node yet — a normal mount / unmount / hot-reload race (hit, e.g., by onProximity) that redboxed in dev and left the awaited promise unsettled (leaked). They now reject with view_not_ready so callers can retry or ignore the transient quietly; the Android path also tests the view type before casting (was risking a ClassCastException).

v2.57.4 — 9 July 2026

  • Stability improvements

v2.57.3 — 2 July 2026

Added

  • Expo SDK 57 / React Native 0.86 support (viro#492). Widened peerDependencies (expo to <58.0.0, react-native to <0.87.0) and engines, and bumped the build/test toolchain (expo 57, react-native 0.86, @react-native/* 0.86, @expo/config-plugins 57). RN 0.86 ships no breaking changes and the Android bridge resolves the host app's RN version dynamically, so no native changes were required.

Changed

  • frontCameraEnabled on iOS now requires the optional @reactvision/react-viro-face-tracking package. ARKit exposes the front camera only through ARFaceTrackingConfiguration (the TrueDepth API), and Apple's App Store review (Guideline 2.5.1) statically scans the binary for it — so bundling it in core caused every app, including rear-camera-only ones (image markers, world tracking), to be flagged for unused TrueDepth code. That path has been extracted from core (companion to @reactvision/virocore 2.57.3's provider seam) into a plug-and-play package whose Expo config plugin adds the pod and injects NSCameraUsageDescription. Apps that need front-camera face tracking install it and declare TrueDepth to Apple; everyone else ships a TrueDepth-free binary that passes 2.5.1 with no configuration. Without the package, frontCameraEnabled is a no-op on iOS (falls through to world tracking). Android is unchanged — front-camera AR (ARCore) stays in core, as there's no Play Store TrueDepth restriction. For a selfie feed without face tracking, use ViroCameraTexture with cameraPosition="front" (AVFoundation, no TrueDepth). See docs/PLATFORM_EXTENSIONS.md.

Fixed

  • ViroVideo no longer crashes or freezes around Android lifecycle transitions (viro#478). With a ViroVideo in the scene, a background/foreground transition could crash the app (ExoPlayer listener callbacks reaching freed native memory after the video was torn down) and leaving the screen could freeze/ANR (the GL render thread blocked calling ExoPlayer on the main thread while the main thread waited for the GL thread in GLSurfaceView.surfaceDestroyed()). Fixed in @reactvision/virocore 2.57.3 via a post-destroy callback guard, a main-thread-refreshed cache for per-frame position/duration, and fire-and-forget play/pause.
  • ViroARImageMarker no longer crashes the app when its target is registered after the marker mounts. Registering targets from a React useEffect (the common pattern) runs after the marker's native view is committed, so VRTARImageMarker looked up a target that did not exist yet and threw an IllegalArgumentException from inside a Fabric prop update — which is fatal under the New Architecture (bridgeless) and tore down the entire ReactHost, terminating the app. The marker no longer throws (matching iOS, which only RCTLogErrors); instead it registers interest by target name with ARTrackingTargetsModule, which now queues waiters for not-yet-registered targets and flushes them when createTargets(...) runs. The marker therefore attaches automatically regardless of whether createTargets runs before or after it mounts.
  • Removed the non-compliant libvrapi.so (viro#491). v2.57.2 aligned every PT_LOAD segment to ≥ 16 KB, but the prebuilt libvrapi.so (Meta VrApi / Oculus Mobile SDK) still had a PT_GNU_RELRO segment ending on a 4 KB boundary, which the Android 15+ linker rejects (dlopen … "libvrapi.so" program alignment (4096) cannot be smaller than system page size (16384)). Because libviro_renderer.so listed libvrapi.so as a NEEDED dependency, it was force-loaded on every launch — so the crash affected all Android apps, not just VR. A prebuilt binary's RELRO padding cannot be re-aligned by a field patch, so the fix removes the dependency entirely.

Removed

  • Deprecated the Oculus Mobile SDK (VrApi) path — ViroPlatform.OVR_MOBILE / ViroViewOVR. VrApi targets EOL hardware (GearVR / Oculus Go) and was superseded by the OpenXR path (ViroPlatform.QUEST / ViroViewOpenXR), which covers all current Meta headsets (Quest 1/2/3/Pro). OVR_MOBILE and ViroViewOVR are now @Deprecated and no longer create a native renderer; selecting OVR_MOBILE logs a warning. Companion to @reactvision/virocore 2.57.3, which drops libvrapi.so and the VrApi renderer from the native build.

v2.57.2 — 29 June 2026

Fixed

  • 16 KB page-size alignment completed for all bundled native libraries (Android). Companion to the renderer fix in @reactvision/virocore 2.57.2. v2.57.0 aligned libopenxr_loader.so, but the prebuilt libc++_shared.so inside the renderer AAR was still 4 KB-aligned (2**12) and failed the 16 KB memory-page requirement for Android 15+ / Google Play. The renderer's Android NDK was bumped from r25 to r27 — whose libc++_shared.so is 16 KB-aligned — and the prebuilt AARs (viro_renderer-release.aar, react_viro-release.aar) were regenerated. Every 64-bit (arm64-v8a) library now reports ≥ 16 KB segment alignment (16 KB / 2**14 for most libs, 64 KB / 2**16 for libvrapi / libgvr), verified with Google's check_elf_alignment.sh (0 unaligned). This unblocks Google Play / Meta Quest Store submission for 16 KB devices.

v2.57.1 — 27 June 2026

Added

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): Bump postcss, expo and @reactvision/react-viro
01ec862 
Bumps [postcss](https://github.com/postcss/postcss) to 8.5.25 and updates ancestor dependencies [postcss](https://github.com/postcss/postcss), [expo](https://github.com/expo/expo/tree/HEAD/packages/expo) and [@reactvision/react-viro](https://github.com/ReactVision/viro). These dependencies need to be updated together.


Updates `postcss` from 8.4.49 to 8.5.25
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.4.49...8.5.25)

Updates `expo` from 53.0.27 to 57.0.9
- [Changelog](https://github.com/expo/expo/blob/main/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/HEAD/packages/expo)

Updates `@reactvision/react-viro` from 2.43.4 to 2.57.5
- [Release notes](https://github.com/ReactVision/viro/releases)
- [Changelog](https://github.com/ReactVision/viro/blob/main/CHANGELOG.md)
- [Commits](ReactVision/viro@v2.43.4...v2.57.5)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: indirect
- dependency-name: expo
  dependency-version: 57.0.9
  dependency-type: direct:production
- dependency-name: "@reactvision/react-viro"
  dependency-version: 2.57.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants