·
Last changedVersion:
This version passed the hardening gate. Hardening applied 5 targeted changes and preserved all other text. Classified findings before hardening: 6. Classified findings closed: 2. Classified findings remaining: 4. Unclassified scanner findings remaining: 0. Review findings closed: 2. Review findings remaining: 10.
4
2
4
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/react-navigation-to-expo-router.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
references/new-architecture.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
references/react-compiler.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
references/native-tabs.md | Prompt Injection | Third-party content as instructions | Low | Closed | |
SKILL.md | Prompt Injection | Third-party content as instructions | Low | Closed |
6 findings
@react-navigation/* imports to expo-router entry points (codemod + manual mapping)Beta versions use .preview suffix (e.g., 55.0.0-preview.2), published under @next tag.
Run diagnostics: npx expo-doctor
Clear caches and reinstall
First check if ios/ and android/ directories exist in the project. If neither directory exists, the project uses Continuous Native Generation (CNG) and native projects are regenerated at build time — skip this section and "Clear caches for bare workflow" entirely.
If upgrading requires native changes:
This regenerates the ios and android directories. Ensure the project is not a bare workflow app before running this command.
These steps only apply when ios/ and/or android/ directories exist in the project:
cd ios && pod install --repo-updatenpx expo run:ios --no-build-cachecd android && ./gradlew clean"experiments": { "reactCompiler": true } to app.json — it's stable and recommendedapp.json to let Expo manage it automaticallypackage.json: @babel/core, babel-preset-expo, expo-constants.| Old Package | Replacement |
|---|---|
|
|
| Individual package permission APIs |
|
|
|
|
|
|
expo-linear-gradient | experimental_backgroundImage + CSS gradients in View |
When migrating deprecated packages, update all code usage before removing the old package. For expo-av, consult the migration references to convert Audio.Sound to useAudioPlayer, Audio.Recording to useAudioRecorder, and Video components to VideoView with useVideoPlayer.
Check if package.json has excluded packages:
Exclusions are often workarounds that may no longer be needed after upgrading. Review each one.
Check if there are any outdated patches in the patches/ directory. Remove them if they are no longer needed.
autoprefixer isn't needed in SDK +53. Remove it from dependencies and check postcss.config.js or postcss.config.mjs to remove it from the plugins list.postcss.config.mjs in SDK +53.Remove redundant metro config options:
experimentalImportSupport is enabled by default in SDK +54.EXPO_USE_FAST_RESOLVER=1 is removed in SDK +54.Since SDK 55, users can opt-in to use Hermes engine v1 for improved runtime performance. This requires setting useHermesV1: true in the expo-build-properties config plugin, and may require a specific version of the hermes-compiler npm package. Hermes v1 will become a default in some future SDK release.
The new architecture is enabled by default, the app.json field "newArchEnabled": true is no longer needed as it's the default. Expo Go only supports the new architecture as of SDK +53.
Get started with chainctlchainctl skill install public/expo/upgrading-expo:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/expo/plugins/expo/skills/upgrading-expo:latest
MIT
HARDENING.md
LICENSE
SKILL.md
agents/openai.yaml
references/expo-av-to-audio.md
references/expo-av-to-video.md
references/native-tabs.md
references/new-architecture.md
references/react-19.md
references/react-compiler.md
references/react-navigation-to-expo-router.md