[pull] main from microsoft:main #33

pull · 2025-04-24T02:36:12Z

See Commits and Changes for more details.

Created by pull[bot] (v2.0.0-alpha.1)

Can you help keep this open source service alive? 💖 Please sponsor : )

Summary: Pull Request resolved: facebook#52193 # Changelog: [Internal] Will be re-used for `console.timeStamp` installation. Reviewed By: motiz88 Differential Revision: D77027561 fbshipit-source-id: ef251541d67011acd21fe9b2be87f9ac1a85a01e

Summary: Pull Request resolved: facebook#52091 # Changelog: [Internal] Adds support for experimental non-standardized `console.timeStamp` API for capturing performance entries on a timeline. The main idea of the API is to be highly performant. More details in the corresponding RCP [1]. NOTE: Because of the `jsinspector-modern` stack gating logic, this won't be installed in production builds. `console.timeStamp` will be polyfilled with a stub - D76987507. Reviewed By: rubennorte Differential Revision: D76284119 fbshipit-source-id: c87c6645fe32f56d84f5915ff57865cfd9723a47

Summary: Pull Request resolved: facebook#52287 Deploy 0.274.1 to xplat Changelog: [Internal] Reviewed By: marcoww6 Differential Revision: D77349884 fbshipit-source-id: 44ebd2c111a6077dbf2e7beb60369283b2256feb

Differential Revision: D76284119 Original commit changeset: c87c6645fe32 Original Phabricator Diff: D76284119 fbshipit-source-id: 186b09de34c3bb3a80eb62d5c14b47d04ca5a8e0

… AnimatedNode::update calls (facebook#52270) Summary: Pull Request resolved: facebook#52270 ## Changelog: [Internal] [Changed] - Reduce call to `folly::dynamic::object` insert and remove unnecessary AnimatedNode::update calls Reviewed By: christophpurrer Differential Revision: D77315659 fbshipit-source-id: 656d7bcc957126ee8fa5a7463223273a93d31369

Summary: Changelog: [Internal] A minimal tweak to a legacy code path for React DevTools in React Native (**NOT** Fusebox!) that enables it to work / not crash when encountering an IPv6 dev server address. See doc comment for more. Reviewed By: hoxyq Differential Revision: D77150288 fbshipit-source-id: c11c742aad7b83861a1242dd13c5ed2753fbdf29

Summary: The argument names in the `onContentSizeChange` callback's type definition differ from the [documentation](https://reactnative.dev/docs/scrollview#oncontentsizechange). ## Changelog:  [GENERAL] [FIXED] - Renamed argument names in the `onContentSizeChange` callback's type definition Pull Request resolved: facebook#52291 Test Plan: The IDE reflects updated argument names. ![Screenshot 2025-06-26 at 14 59 40](https://github.com/user-attachments/assets/1579998a-d9a8-4b98-a664-e5106ffb42f5) Reviewed By: fabriziocucci Differential Revision: D77373877 Pulled By: rshest fbshipit-source-id: 2a171e1bc16103320f5ec31efab896f6b840fb96

Summary: # Changelog: [Internal] Adds support for experimental non-standardized `console.timeStamp` API for capturing performance entries on a timeline. The main idea of the API is to be highly performant. More details in the corresponding RCP [1]. NOTE: Because of the `jsinspector-modern` stack gating logic, this won't be installed in production builds. `console.timeStamp` will be polyfilled with a stub - D76987507. Reviewed By: rubennorte Differential Revision: D77374707 fbshipit-source-id: cb66b9fda06168f4b13af764afe95a63a0a8d5a0

…ok#52286) Summary: To make sure we are exposing the same public API to swift as without prebuilt, this commit changes the follow: - ModuleMap / Umbrella file is generated from template, not dynamically to align with non-prebuilt (cocoapods). This is temporary, we are already working toward a solution to generate them dynamically. - Headers are extracted by reading from podspec files and expanding their globs. This is now easy since we can use the podspec_sources function to look for file globs. ## Changelog: [Internal] - refactored header/umbrella/modulemap generation for prebuild Pull Request resolved: facebook#52286 Test Plan: - Run RN-tester with/without prebuilts - Create new RN app based on nightly, build with/without prebuiltsTo make sure we expose all the swift features that we should, we expose and declare a variable from React_RCTAppDelegate Rollback Plan: Reviewed By: cortinico Differential Revision: D77368255 Pulled By: cipolleschi fbshipit-source-id: 88e2c9d1622753895c8667a9b5aeae4a0d332cc4

…rface (facebook#52293) Summary: Pull Request resolved: facebook#52293 # Changelog: [Internal] - Adds a helper method to the `IMountingManager` API in order to get the platform specific image loader implementation, if available. Reviewed By: christophpurrer Differential Revision: D77379053 fbshipit-source-id: b7595d78c83e9270ec1818daf2d0f1d342661e52

Summary: Pull Request resolved: facebook#52292 Adds a new transform that annotates all exported symbols in our V2 JS API snapshot with a version hash based on the shape of all input types. This intends to be a reliable mechanism to indicate how changes to local types will ultimately affect exported types. **Advantages** (over our alternative type inlining prototype) - More intuitive to developers — in that source type changes are preserved closer to their original source code shapes. - Enables useful Git blaming of individual exported APIs — hash for each export line will change every time a type is affected, and relevant commits can be looked up based on this. - Handles recursive types. - Can be **best-effort** with minimal structural effect over time. We are okay with false positives that over-match input type changes (these are refined later in the stack). - Similar to this, is **lower risk** in terms of requiring future updates that may pollute the diff of the body of the API snapshot structurally. **Example change** Example type change with multiple references: D77378010 {F1979784798} ✅ 8 char hash based on input type shapes printed next to each root-exported identifier ✅ For a source change to the `AccessibilityProps` type, 33 dependent exported types are updated with a new hash Changelog: [Internal] Reviewed By: cipolleschi Differential Revision: D77303917 fbshipit-source-id: 9d43a617697418218eb4951e8e9858d125e222b3

…52298) Summary: Pull Request resolved: facebook#52298 Exposes the ability to output inline debug annotations for the `versionExportedApis` transform (D77303917) as a formalised `--debug-version-annotations` CLI flag. This is helpful for debugging and future maintenance, and will be used to show the effect of the next diffs. Changelog: [Internal] Reviewed By: cipolleschi Differential Revision: D77373723 fbshipit-source-id: 91c91abcb657ab88ee2f8209efccb4024602acc7

…2299) Summary: Pull Request resolved: facebook#52299 Correctness improvement to the `versionExportedApis` transform (D77303917). Now handles namespaced references (e.g. `Animated.Value`) by redirecting to the locally defined type name. Changelog: [Internal] Reviewed By: cipolleschi Differential Revision: D77314293 fbshipit-source-id: 6442d3ab0a3c8bebf6593455b1c2fb74266e657f

Summary: Pull Request resolved: facebook#52300 Targeted improvement to `versionExportedApis` (D77303917) to reduce noise. This eliminates the false positive from a rename to a local (unexported) type, that does not structurally change the shape of exported types. Changelog: [Internal] Reviewed By: rubennorte Differential Revision: D77314292 fbshipit-source-id: 4de90f5b5f1b622225762b2a73e386538000d54a

) Summary: Pull Request resolved: facebook#52295 The current setup for several of our podspecs abuses the `**` globbing mechanism, forcing us to specify some excluded folders. By excplicitly mention the folders that we want to use on iOS, we can avoid the usage of the `exclude_files` property. This should make the setup more reliable and it will also avoid to leak to OSS the presence of some folders we only use internally like `platform/macos` and `platform/windows` ## Changelog: [Internal] - Reviewed By: huntie Differential Revision: D77381512 fbshipit-source-id: 4cb9118bf9f0ecd253d7d871341f733564d84c83

) Summary: Pull Request resolved: facebook#52294 changelog: [internal] Views that are hidden provide couple perf benefits: - The layer is skipped during hit-testing, so the view no longer receives touches. - Compositing work for the layer is skipped, so nothing is uploaded to the GPU for that view. Note, VirtualView still occupies space in memory and because this is infinite list and its numbers will grow unbounded. In this diff, hidden = YES is only set when VirtualView does not participate in accessibility features. Reviewed By: yungsters Differential Revision: D76597973 fbshipit-source-id: 10eb36fccabba9e37cc6322ed5969b8502193a5f

Summary: Pull Request resolved: facebook#52222 Changelog: [Internal] Introduce environment option to force usage of OSS fantom test runner. If env is not set - check for BUCK file in tester which is checked in for FB but not for OSS. Reviewed By: rubennorte Differential Revision: D77160761 fbshipit-source-id: 1701ff140ff2be1bbeacfb4305e9f89089cacb42

…ponentDescriptor" (facebook#52269) Summary: Pull Request resolved: facebook#52269 Relanding the reverted PR. Differential Revision: D77282452 fbshipit-source-id: 1480d8ab067bbbb1b41a9cd03315748c1311f910

Summary: Pull Request resolved: facebook#52302 Enable experimental.pattern_matching=true Changelog: [internal] Reviewed By: pieterv Differential Revision: D77367102 fbshipit-source-id: a71352a58470c30fa7e466a67cb1909d80f0363e

…ck (facebook#52276) Summary: Pull Request resolved: facebook#52276 The line metrics reported do not process the Spannable, meaning their layout results may disagree with those used for measurement and display. Changelog: [Android][Fixed] - Fix onTextLayout metrics not incorporating ReactTextViewManagerCallback Reviewed By: lenaic Differential Revision: D77261839 fbshipit-source-id: 87bdc86ce16a2ae9fa69532c5721c19567a53595

… soundness fix in react-native (facebook#52305) Summary: Pull Request resolved: facebook#52305 Changelog: [Internal] Reviewed By: marcoww6 Differential Revision: D77386425 fbshipit-source-id: d69184abb1c8f7c516229aafe24dd418b5dd887e

Summary: Pull Request resolved: facebook#52306 The RCTPushNotificationManager is deprecated and not part of the prebuilds as it is optional. We mistakenly added it to the umbrella header and nightlies do not work with prebuilds. This change removes the header ad should fix the build. ## Changelog: [Internal] - Reviewed By: philIip Differential Revision: D77395754 fbshipit-source-id: 66371650dc56f5be16a00319d9e4a1078a7b68bd

Summary: Pull Request resolved: facebook#52296 ## Changelog: [Internal] [Changed] - Fewer calls to direct manipulation callback `NativeAnimatedNodesManager::onRender` is supposed to run each frame for c++ animation, from the callstack sample trace, the vast majority of time is spent on `updateNodes` (run update on all AnimatedNodes) and `commitProps` (where either Fabric ShadowTree commit or direct manipulation is called). Change in this PR is supposed to reduce time spent in `commitProps` {F1979788964} Reviewed By: sammy-SC Differential Revision: D77380842 fbshipit-source-id: 2f25ca1fba4171a7b3e485298738379d0daff3ad

…e for Bridgeless" (facebook#52303) Summary: Pull Request resolved: facebook#52303 Investigating javascript crash regression between Store APK v269 and v270 T228736366 with mid https://www.internalfb.com/logview/system_vros_javascripterrors/4a0131b8b79e3994b639c7ca212db717?ds=%7B%22start%22%3A%221750796919%22%2C%22constraints%22%3A[]%2C%22end%22%3A%22now%22%7D&ds_nux_type=task We suspect that this diff stack may be causing the issue could be caused by this Kotlin migration diff stack D76908041 Changelog: [Internal] Reverting Kotlin migration for ReactDelegate Reviewed By: mullender Differential Revision: D77388413 fbshipit-source-id: b144ca6db6f75614c7988e474ef89f19714a4a09

Summary: Pull Request resolved: facebook#52304 Investigating javascript crash regression between Store APK v269 and v270 T228736366 with mid https://www.internalfb.com/logview/system_vros_javascripterrors/4a0131b8b79e3994b639c7ca212db717?ds=%7B%22start%22%3A%221750796919%22%2C%22constraints%22%3A[]%2C%22end%22%3A%22now%22%7D&ds_nux_type=task We suspect that this diff stack may be causing the issue could be caused by this Kotlin migration diff stack D76908041 Changelog: [Internal] Reverting Kotlin migration for `ReactDelegate` Reviewed By: gorodscy, mullender Differential Revision: D77388940 fbshipit-source-id: 4a366205ea9c515a1561a4624b8d29e81ab9bae9

…ative-github/packages/react-native/ReactAndroid/src/main/jni/react/hermes/instrumentation (facebook#52285) Summary: Pull Request resolved: facebook#52285 Reviewed By: cortinico Differential Revision: D77359122 fbshipit-source-id: ad425cdfecf57210ae79a8bad25fde4896b476c1

…acebook#52301) Summary: Pull Request resolved: facebook#52301 Readying for imminent productionisation. Changelog: [Internal] Reviewed By: j-piasecki Differential Revision: D77386064 fbshipit-source-id: 2769545eace4e6c09da0b2f0f34cf74b2fdcb730

Summary: Pull Request resolved: facebook#52309 This is another class going from Java to Kotlin. Thish should have no breaking changes, but I'll keep an eye to see if this is disruptive for users in the ecosystem. I also haven't removed any of the Deprecated method, which can be cleaned up afterwards. Changelog: [Android] [Changed] - Migrate ThemedReactContext to Kotlin Reviewed By: javache Differential Revision: D77374236 fbshipit-source-id: d1787b21897b01c45bbf841fdda00972e0be58db

Summary: This follows facebook#47554 Compared to the initial proposal, I had to remove the `edgeToEdgeEnabled` property from the root `gradle.properties` and put it in the app `gradle.properties` instead (explaining the `AgpConfiguratorUtils.kt` / `GenerateEntryPointTask.kt` / `ProjectUtils.kt` / `PropertyUtils.kt` changes) This PR: - Enable edge-to-edge for `MainActivity` (when `edgeToEdgeEnabled` is set to `true`) - Disable `StatusBar` `backgroundColor` and `translucent` (when `edgeToEdgeEnabled` is set to `true`) - Enforce `statusBarTranslucent` and `navigationBarTranslucent` on `Modal` when edge-to-edge is enabled - Add an `isEdgeToEdge` constant to `DeviceInfoModule` for [`react-native-is-edge-to-edge`](https://github.com/zoontek/react-native-edge-to-edge/tree/main/react-native-is-edge-to-edge) detection ## Changelog:  - [Android] [Added] - Add edge-to-edge opt-in support Pull Request resolved: facebook#52088 Test Plan: - Update `enableEdgeToEdge` value in `packages/rn-tester/android/app/gradle.properties` - Recompile https://github.com/user-attachments/assets/4c6beb98-fa88-427c-b62d-a42ffe5330f0 Rollback Plan: Reviewed By: cortinico Differential Revision: D76834213 Pulled By: alanleedev fbshipit-source-id: c39b2cff1a5e94e31306e3b35651aa2de83d2fe6

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.14.1 to 3.14.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md">js-yaml's changelog</a>.</em></p> <blockquote> <h2>[3.14.2] - 2025-11-15</h2> <h3>Security</h3> <ul> <li>Backported v4.1.1 fix to v3</li> </ul> <h2>[4.1.1] - 2025-11-12</h2> <h3>Security</h3> <ul> <li>Fix prototype pollution issue in yaml merge (<<) operator.</li> </ul> <h2>[4.1.0] - 2021-04-15</h2> <h3>Added</h3> <ul> <li>Types are now exported as <code>yaml.types.XXX</code>.</li> <li>Every type now has <code>options</code> property with original arguments kept as they were (see <code>yaml.types.int.options</code> as an example).</li> </ul> <h3>Changed</h3> <ul> <li><code>Schema.extend()</code> now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as <code>abcd</code> instead of <code>cbad</code>).</li> </ul> <h2>[4.0.0] - 2021-01-03</h2> <h3>Changed</h3> <ul> <li>Check <a href="https://github.com/nodeca/js-yaml/blob/master/migrate_v3_to_v4.md">migration guide</a> to see details for all breaking changes.</li> <li>Breaking: "unsafe" tags <code>!!js/function</code>, <code>!!js/regexp</code>, <code>!!js/undefined</code> are moved to <a href="https://github.com/nodeca/js-yaml-js-types">js-yaml-js-types</a> package.</li> <li>Breaking: removed <code>safe*</code> functions. Use <code>load</code>, <code>loadAll</code>, <code>dump</code> instead which are all now safe by default.</li> <li><code>yaml.DEFAULT_SAFE_SCHEMA</code> and <code>yaml.DEFAULT_FULL_SCHEMA</code> are removed, use <code>yaml.DEFAULT_SCHEMA</code> instead.</li> <li><code>yaml.Schema.create(schema, tags)</code> is removed, use <code>schema.extend(tags)</code> instead.</li> <li><code>!!binary</code> now always mapped to <code>Uint8Array</code> on load.</li> <li>Reduced nesting of <code>/lib</code> folder.</li> <li>Parse numbers according to YAML 1.2 instead of YAML 1.1 (<code>01234</code> is now decimal, <code>0o1234</code> is octal, <code>1:23</code> is parsed as string instead of base60).</li> <li><code>dump()</code> no longer quotes <code>:</code>, <code>[</code>, <code>]</code>, <code>(</code>, <code>)</code> except when necessary, <a href="https://redirect.github.com/nodeca/js-yaml/issues/470">#470</a>, <a href="https://redirect.github.com/nodeca/js-yaml/issues/557">#557</a>.</li> <li>Line and column in exceptions are now formatted as <code>(X:Y)</code> instead of <code>at line X, column Y</code> (also present in compact format), <a href="https://redirect.github.com/nodeca/js-yaml/issues/332">#332</a>.</li> <li>Code snippet created in exceptions now contains multiple lines with line numbers.</li> <li><code>dump()</code> now serializes <code>undefined</code> as <code>null</code> in collections and removes keys with <code>undefined</code> in mappings, <a href="https://redirect.github.com/nodeca/js-yaml/issues/571">#571</a>.</li> <li><code>dump()</code> with <code>skipInvalid=true</code> now serializes invalid items in collections as null.</li> <li>Custom tags starting with <code>!</code> are now dumped as <code>!tag</code> instead of <code>!<!tag></code>, <a href="https://redirect.github.com/nodeca/js-yaml/issues/576">#576</a>.</li> <li>Custom tags starting with <code>tag:yaml.org,2002:</code> are now shorthanded using <code>!!</code>, <a href="https://redirect.github.com/nodeca/js-yaml/issues/258">#258</a>.</li> </ul> <h3>Added</h3> <ul> <li>Added <code>.mjs</code> (es modules) support.</li> <li>Added <code>quotingType</code> and <code>forceQuotes</code> options for dumper to configure string literal style, <a href="https://redirect.github.com/nodeca/js-yaml/issues/290">#290</a>, <a href="https://redirect.github.com/nodeca/js-yaml/issues/529">#529</a>.</li> <li>Added <code>styles: { '!!null': 'empty' }</code> option for dumper (serializes <code>{ foo: null }</code> as "<code>foo: </code>"), <a href="https://redirect.github.com/nodeca/js-yaml/issues/570">#570</a>.</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodeca/js-yaml/commit/9963d366dfbde0c69722452bcd40b41e7e4160a0"><code>9963d36</code></a> 3.14.2 released</li> <li><a href="https://github.com/nodeca/js-yaml/commit/10d3c8e70a6888543f5cdb656bb39f73e0ea77c1"><code>10d3c8e</code></a> dist rebuild</li> <li><a href="https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266"><code>5278870</code></a> fix prototype pollution in merge (<<) (<a href="https://redirect.github.com/nodeca/js-yaml/issues/731">#731</a>)</li> <li>See full diff in <a href="https://github.com/nodeca/js-yaml/compare/3.14.1...3.14.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=js-yaml&package-manager=npm_and_yarn&previous-version=3.14.1&new-version=3.14.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/react-native-macos/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

#2769) Bumps [mdast-util-to-hast](https://github.com/syntax-tree/mdast-util-to-hast) from 13.2.0 to 13.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/syntax-tree/mdast-util-to-hast/releases">mdast-util-to-hast's releases</a>.</em></p> <blockquote> <h2>13.2.1</h2> <h4>Fix</h4> <ul> <li>ab3a795 Fix support for spaces in class names</li> </ul> <h4>Types</h4> <ul> <li>efb5312 Refactor to use <code>@import</code>s</li> <li>a5bc210 Add declaration maps</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/syntax-tree/mdast-util-to-hast/compare/13.2.0...13.2.1">https://github.com/syntax-tree/mdast-util-to-hast/compare/13.2.0...13.2.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/syntax-tree/mdast-util-to-hast/commit/174795b21f7757fffb54dd8d5fb4012f4751f791"><code>174795b</code></a> 13.2.1</li> <li><a href="https://github.com/syntax-tree/mdast-util-to-hast/commit/3d05b3a715133df55689fe3753c2e47101315b4e"><code>3d05b3a</code></a> Update Node in Actions</li> <li><a href="https://github.com/syntax-tree/mdast-util-to-hast/commit/ab3a79570a1afbfa7efef5d4a0cd9b5caafbc5d7"><code>ab3a795</code></a> Fix support for spaces in class names</li> <li><a href="https://github.com/syntax-tree/mdast-util-to-hast/commit/efb531231020055e0dab7b39a18d80b569d5b566"><code>efb5312</code></a> Refactor to use <code>@import</code>s</li> <li><a href="https://github.com/syntax-tree/mdast-util-to-hast/commit/a5bc210f1aa308e4c6141ac374893c9237fcd746"><code>a5bc210</code></a> Add declaration maps</li> <li><a href="https://github.com/syntax-tree/mdast-util-to-hast/commit/b54955d4e123b0167eac13646333c809bb8f301c"><code>b54955d</code></a> Add <code>.tsbuildinfo</code> to <code>.gitignore</code></li> <li>See full diff in <a href="https://github.com/syntax-tree/mdast-util-to-hast/compare/13.2.0...13.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=mdast-util-to-hast&package-manager=npm_and_yarn&previous-version=13.2.0&new-version=13.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/react-native-macos/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

## Summary: Make a change (yarn dedupe) to force CI to run so we can investigate and fix ## Test Plan: CI should pass

Bumps [validator](https://github.com/validatorjs/validator.js) from 13.15.20 to 13.15.23. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/validatorjs/validator.js/releases">validator's releases</a>.</em></p> <blockquote> <h2>13.15.23</h2> <h3>Fixes, New Locales and Enhancements</h3> <ul> <li><strong>Doc fixes and others:</strong> <ul> <li><a href="https://redirect.github.com/validatorjs/validator.js/pull/2631">#2631</a> <a href="https://github.com/WikiRik"><code>@WikiRik</code></a></li> </ul> </li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/validatorjs/validator.js/compare/13.15.22...13.15.23">https://github.com/validatorjs/validator.js/compare/13.15.22...13.15.23</a></p> <h2>13.15.22</h2> <h3>Fixes, New Locales and Enhancements</h3> <ul> <li><a href="https://redirect.github.com/validatorjs/validator.js/pull/2622">#2622</a> <code>isURL</code>: fix regression with hostnames with ports <a href="https://github.com/mbtools"><code>@mbtools</code></a></li> <li><a href="https://redirect.github.com/validatorjs/validator.js/pull/2616">#2616</a> <code>isLength</code>: improve handling Unicode variation selectors <a href="https://github.com/koral"><code>@koral</code></a>--</li> <li><strong>Doc fixes and others:</strong> <ul> <li><a href="https://redirect.github.com/validatorjs/validator.js/pull/2621">#2621</a> <a href="https://github.com/mbtools"><code>@mbtools</code></a></li> </ul> </li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/mbtools"><code>@mbtools</code></a> made their first contribution in <a href="https://redirect.github.com/validatorjs/validator.js/pull/2622">validatorjs/validator.js#2622</a></li> <li><a href="https://github.com/koral"><code>@koral</code></a>-- made their first contribution in <a href="https://redirect.github.com/validatorjs/validator.js/pull/2616">validatorjs/validator.js#2616</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/validatorjs/validator.js/compare/13.15.20...13.15.22">https://github.com/validatorjs/validator.js/compare/13.15.20...13.15.22</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md">validator's changelog</a>.</em></p> <blockquote> <h1>13.15.23</h1> <h3>Fixes, New Locales and Enhancements</h3> <ul> <li><strong>Doc fixes and others:</strong> <ul> <li><a href="https://redirect.github.com/validatorjs/validator.js/pull/2631">#2631</a> <a href="https://github.com/WikiRik"><code>@WikiRik</code></a></li> </ul> </li> </ul> <h1>13.15.22</h1> <h3>Fixes, New Locales and Enhancements</h3> <ul> <li><a href="https://redirect.github.com/validatorjs/validator.js/pull/2622">#2622</a> <code>isURL</code>: fix regression with hostnames with ports <a href="https://github.com/mbtools"><code>@mbtools</code></a></li> <li><a href="https://redirect.github.com/validatorjs/validator.js/pull/2616">#2616</a> <code>isLength</code>: improve handling Unicode variation selectors <a href="https://github.com/koral"><code>@koral</code></a>--</li> <li><strong>Doc fixes and others:</strong> <ul> <li><a href="https://redirect.github.com/validatorjs/validator.js/pull/2621">#2621</a> <a href="https://github.com/mbtools"><code>@mbtools</code></a></li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/validatorjs/validator.js/commit/9113304819ae2627c1b7e9c5994a76f60efbe0b6"><code>9113304</code></a> fix(build): move to trusted publishing (<a href="https://redirect.github.com/validatorjs/validator.js/issues/2631">#2631</a>)</li> <li><a href="https://github.com/validatorjs/validator.js/commit/f2b5c17dbe03f2ca9ad9122c597f81e86ce1a9a1"><code>f2b5c17</code></a> maintenance: 2511 release (<a href="https://redirect.github.com/validatorjs/validator.js/issues/2627">#2627</a>)</li> <li><a href="https://github.com/validatorjs/validator.js/commit/d457ecaf55b0f3d8bd379d82757425d0d13dd382"><code>d457eca</code></a> fix(isLength): correctly handle Unicode variation selectors (<a href="https://redirect.github.com/validatorjs/validator.js/issues/2616">#2616</a>)</li> <li><a href="https://github.com/validatorjs/validator.js/commit/f2e3633f22fd3016656789d100bc451d857e7488"><code>f2e3633</code></a> docs: add install instructions to contibution guide (<a href="https://redirect.github.com/validatorjs/validator.js/issues/2621">#2621</a>)</li> <li><a href="https://github.com/validatorjs/validator.js/commit/cf401458b8733d981a3724d634c795a9d612b516"><code>cf40145</code></a> fix: URL validation for hostnames with ports (no protocol) (<a href="https://redirect.github.com/validatorjs/validator.js/issues/2622">#2622</a>)</li> <li><a href="https://github.com/validatorjs/validator.js/commit/4af61243ba0ae93f29e7689040e188b5849ff1b0"><code>4af6124</code></a> maintenance: 2510 release (<a href="https://redirect.github.com/validatorjs/validator.js/issues/2585">#2585</a>)</li> <li>See full diff in <a href="https://github.com/validatorjs/validator.js/compare/13.15.20...13.15.23">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by [GitHub Actions](<a href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a> Actions), a new releaser for validator since your current version.</p> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=validator&package-manager=npm_and_yarn&previous-version=13.15.20&new-version=13.15.23)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/react-native-macos/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Saad Najmi <[email protected]>

Bumps [node-forge](https://github.com/digitalbazaar/forge) from 1.3.1 to 1.3.3. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md">node-forge's changelog</a>.</em></p> <blockquote> <h2>1.3.3 - 2025-12-02</h2> <h3>Fixed</h3> <ul> <li>[pkcs12] Make digestAlgorithm parameters optional to fix PKCS#12/PFX issues introduced in 1.3.2.</li> </ul> <h2>1.3.2 - 2025-11-25</h2> <h3>Security</h3> <ul> <li><strong>HIGH</strong>: ASN.1 Validator Desynchronization <ul> <li>An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.</li> <li>Reported by Hunter Wodzenski.</li> <li>CVE ID: <a href="https://www.cve.org/CVERecord?id=CVE-2025-12816">CVE-2025-12816</a></li> <li>GHSA ID: <a href="https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq">GHSA-5gfm-wpxj-wjgq</a></li> </ul> </li> <li><strong>HIGH</strong>: ASN.1 Unbounded Recursion <ul> <li>An Uncontrolled Recursion (CWE-674) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs.</li> <li>Reported by Hunter Wodzenski.</li> <li>CVE ID: <a href="https://www.cve.org/CVERecord?id=CVE-2025-66031">CVE-2025-66031</a></li> <li>GHSA ID: <a href="https://github.com/digitalbazaar/forge/security/advisories/GHSA-554w-wpv2-vw27">GHSA-554w-wpv2-vw27</a></li> </ul> </li> <li><strong>MODERATE</strong>: ASN.1 OID Integer Truncation <ul> <li>An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions.</li> <li>Reported by Hunter Wodzenski.</li> <li>CVE ID: <a href="https://www.cve.org/CVERecord?id=CVE-2025-66030">CVE-2025-66030</a></li> <li>GHSA ID: <a href="https://github.com/digitalbazaar/forge/security/advisories/GHSA-65ch-62r8-g69g">GHSA-65ch-62r8-g69g</a></li> </ul> </li> </ul> <h3>Fixed</h3> <ul> <li>[asn1] Fix for vulnerability identified by CVE-2025-12816 PKCS#12 MAC verification bypass due to missing macData enforcement and improper asn1.validate routine.</li> <li>[asn1] Add <code>fromDer()</code> max recursion depth check. <ul> <li>Add a <code>asn1.maxDepth</code> global configurable maximum depth of 256.</li> <li>Add a <code>asn1.fromDer()</code> per-call <code>maxDepth</code> option.</li> <li><strong>NOTE</strong>: The default maximum is assumed to be higher than needed for valid data. If this assumption is false then this could be a breaking change. Please file an issue if there are use cases that need a higher maximum.</li> <li><strong>NOTE</strong>: The per-call <code>maxDepth</code> parameter has not been exposed up through all of the API stack due to the complexities involved. Please file an issue if there are use cases that require this instead of changing the default</li> </ul> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/digitalbazaar/forge/commit/1cea0aff4901589ae86e314f25782bbe312f9f69"><code>1cea0af</code></a> Release 1.3.3.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/5265989cf5e54cfe1e27a10d71523007ce0507b1"><code>5265989</code></a> Update changelog.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/e4f3961406395dd8e985dcf841852ceca73ac3a9"><code>e4f3961</code></a> Fix changelog for release.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/503979b0295cf633a30199d6bd937f4a222481a0"><code>503979b</code></a> Update changelog.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/c3b3b32a8c157ac57752934d3af63b5f798b58b8"><code>c3b3b32</code></a> Make digestAlgorithm parameters optional</li> <li><a href="https://github.com/digitalbazaar/forge/commit/6f70043a6db1abb9f3304f3d432efed3ba50fcca"><code>6f70043</code></a> Update CVE details.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/f547b0d292745094190ecb250429d21e8804a375"><code>f547b0d</code></a> Start 1.3.3-0.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/235ad3e70e4fdfdca4fdeb662dfba6588e2c38bd"><code>235ad3e</code></a> Release 1.3.2.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/25982441171dc9815c87d3d886c5c8a1d092b334"><code>2598244</code></a> Update changelog.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/0032dd0be8b6fb1b1092ef754d1dde91c10a95ad"><code>0032dd0</code></a> Fix typos.</li> <li>Additional commits viewable in <a href="https://github.com/digitalbazaar/forge/compare/v1.3.1...v1.3.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=node-forge&package-manager=npm_and_yarn&previous-version=1.3.1&new-version=1.3.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/react-native-macos/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

## Summary Fixes a typo (single-character correction). ## Test Plan N/A — no functional changes.

## Summary: This PR is split out from #2766 to help make it smaller. Previously we had the code `@compatibility_alias UIImage NSImage` which is basically an objective C runtime way of doing `#define UIImage NSImage`. We don't quite like this, since we are defining the symbol `UIImage` in an Appkit context. We have a better pattern we can copy from RCTPlatformView --> RCTPlatformImage. The `RCTPlatform` prefix basically means it's NS<blah> on Appkit and UI<blah> on UIKit. This is as opposed to something like RCTUIView, where on iOS it's a typedef, but on macOS it's a subclass that adds stuff to NSView to make it more compatible with UIView. All in all, this should mostly be a rigorous find/replace to make the code slightly more strict, but have no behavioral changes ## Test Plan: RNTester runs locally.

## Summary: Needs #2783 to merge first. Resolves #2738 There were a couple of issues with our macOS image rendering code that caused borders and shadows to not render properly in Fabric: 1. Our shim for `UIGraphicsImageRenderer` on macOS (`RCTUIGraphicsImageRenderer`) called `[NSImage imageWithActions:flipped:drawingHandler]`, which would not render the imade right away but instead when it's about to be displayed (presumably so that it can generate a proper `CGContext` for the screen the image is on). This meant that CGImage bitmap would sometimes just return as `0x0` 1. `NSImage` unlike `UIImage` does not have a `CGImage` property, so we used the method `CGImageForProposedRect:` to get one. Unfortunately, that returns an autoreleased CGImage, and when we later set that to RCTViewComponentViews' `layer.contents`, it would not be retained. This manifested as borders and shadows not rendering, or rendering and then dissapearing on a resize. To fix the first issue, apparently we can just call `[image lockFocus]` and `[image unlockFocus]` in succession to force it to render a bitmap. To fix the second issue, we need some way to cache the CGImage. I propose a new class: `RCTUIImage`. `RCTUIImage`, like `RCTUIView` is a subclass of `NSImage` with some extra properties and methods to make it more compatible with iOS code. In our case, we add the extra code to cache a CGImage, with proper retain and release calls. We can then have `RCTUIGraphicsImageRenderer` return our new subclass, and update all callers appropiately. The end result it we can actually remove some diffs, and have our macOS image handling behave closer to iOS. While doing this work, I realized our `NSImage` / `UIImage` shims were kinda messy, and with the new subclass to introduce weird runtime edge cases. I split out #2783 to help clean up and clarify what image class we're using in the rest of the codebase. While here, I also fixed an issue with clipsToBounds on macOS which was the final piece to get shadows and borders working. ## Test Plan: RNTester seems better :) https://github.com/user-attachments/assets/a5afe150-15ae-4c92-9219-8843aa5362ac

## Summary: Since #2694 tests run on macos 26, which used Xcode 26.0.1 [by default](https://github.com/actions/runner-images/blob/main/images/macos/macos-26-arm64-Readme.md) causing the `"/Applications/Xcode_16.4.0.app"` path to fail in the "Setup toolchain" phase ## Test Plan: CI should not fail in the Setup toolchain phase

## Summary: Helps (but doesn't fix) #2789 Replace the custom bash script to pin cmake with an action that upstream React Native is using.

Resolves #2789 ## Summary: Upstream, the Hermes repo changed their default branch from `main` (Legacy Hermes) to `static_h` (HermesV1). Our scripts to look up and build Hermes from source (used on our `main` branch) started pulling in HermesV1 instead of legacy hermes, which we won't support till RN 0.84. Let's fix the lookup logic so always look up the commit from Hermes' `main` branch instead. Let's also update cmake to a version that supports visionOS ## Test Plan: Revert my commit to use JSC on CI so we can see if Hermes passes.

Co-authored-by: gabrieldonadel <[email protected]>

…mage>

…, and accessibilityElements

@gabrieldonadel

## Summary: Merge up to where `0.81-stable` forked from main, determined by running `git merge-base main 0.81-stable` on the upstream React Native repo. Picked up some changes by @gabrieldonadel from #2787 Along the way, we: - Updated the repo to use `RCTPlatformImage` when possible, to distinguish from `UIImage` and `RCTUIImage. Same for `RCTPlatformView` in a couple of new places. - Implemented `RCTUIScrollViewDelegate` for `RCTUIScrollView` so that we could implement `RCTVirtualViewComponentView` better - Implemented `RCTViewAccessibilityElement`, which required better shims for `UIAccessibilityTraits` and `accessibilityElements` - Used `RCTPlatformDisplayLink` to properly implement `RCTUIImageViewAnimated` - (Finallly) Implemented RCTPerfMonitor. All in all looking like a good merge 🙂 ## Test Plan: CI should pass. Local pass of affected areas