Skip to content

Upgrade glob@7 to glob@10 to resolve deprecation warnings#48875

Closed
byCedric wants to merge 1 commit into
facebook:mainfrom
byCedric:@bycedric/glob/upgrade-to-glob-10
Closed

Upgrade glob@7 to glob@10 to resolve deprecation warnings#48875
byCedric wants to merge 1 commit into
facebook:mainfrom
byCedric:@bycedric/glob/upgrade-to-glob-10

Conversation

@byCedric
Copy link
Copy Markdown
Contributor

@byCedric byCedric commented Jan 22, 2025 •
edited
Loading

Summary:

This is a long overdue follow-up from #46724, and upgrades the deprecated glob@7 to glob@10.

When creating any React Native project today, you are greeted by a wall of deprecation warnings when installing with npm -- with the most frequent offender being glob@7.2.3. This hurts UX and diminishes developers' trust, even before starting their project.

image

Unfortunately, no flow types are available for glob@9+. I've tried creating a flow definition, but it turns out that the glob@10 types use path-scurry@^1.11.1, minimatch@^9.0.4, and minipass@^7.1.2 -- all without flow type definitions. Writing the flow definitions for glob@9+ is non-trivial work, I'd be happy to help but I can't fix that on my own.

Important

glob@11 has already been released, but it's only supporting Node 20+. I believe React Native still supports Node 18 until the EOL in April 2025, that's why I used glob@10.

Changelog:

[GENERAL] [CHANGED] - Upgrade from deprecated glob@7 to supported glob@10

Test Plan:

  • npm create expo@latest ./test-install-warnings
  • cd ./test-install-warnings
  • rm -rf node_modules
  • npm install
  • npm list glob@7.2.3

Most of the offending packages come from React Native packages, with some from jest/jest-expo.

image

@facebook-github-bot facebook-github-bot added CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. p: Expo Partner: Expo Partner Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team. labels Jan 22, 2025
@byCedric byCedric mentioned this pull request Jan 23, 2025
Closed
@cortinico cortinico requested review from huntie and robhogan February 12, 2025 17:22
@cortinico
Copy link
Copy Markdown
Contributor

cortinico commented Feb 12, 2025

@robhogan @huntie are you folks able to give a sense of how big of an effort this one is going to be?

@huntie huntie self-assigned this Feb 13, 2025
@huntie
Copy link
Copy Markdown
Member

huntie commented Feb 13, 2025

Looks like just Flow errors. Will import and resolve.

@facebook-github-bot
Copy link
Copy Markdown
Contributor

facebook-github-bot commented Feb 13, 2025

@huntie has imported this pull request. If you are a Meta employee, you can view this diff on Phabricator.

@huntie
Copy link
Copy Markdown
Member

huntie commented Feb 18, 2025

@byCedric

  • I've rebased and added valid glob_v10.x.x Flow types.
  • There's one load-bearing call site for users, which we want to validate hasn't broken on Windows (per the glob changelog, thanks @robhogan!):
    • packages/react-native-codegen/src/cli/combine/combine-js-to-schema.js

Will see if I have time to test this today (need to secure a Windows device from around the office).

@byCedric
Copy link
Copy Markdown
Contributor Author

byCedric commented Feb 24, 2025

Hey @huntie! I just got back from my Lunar new year tour. If there is any way I can help test the Glob changes on Windows, lmk. I literally have 2 desktops ready to go for that.

robhogan pushed a commit to facebook/metro that referenced this pull request Feb 26, 2025
@byCedric @facebook-github-bot
Upgrade glob@7 to glob@10 to resolve deprecation warnings
8cd4aa0 
Summary:
This is a long overdue follow-up from facebook/react-native#46724, and upgrades the deprecated `glob@7` to `glob@10`.

When creating any React Native project today, you are greeted by a wall of deprecation warnings when installing with `npm` -- with the most frequent offender being `glob@7.2.3`. This hurts UX and diminishes developers' trust, even before starting their project.

<img width="1005" alt="image" src="https://github.com/user-attachments/assets/a5661470-98df-4f3f-8be2-7b0baa9711b6" />

Unfortunately, no [flow types are available for `glob@9+`](https://github.com/flow-typed/flow-typed/tree/main/definitions/npm). I've tried creating a flow definition, but it turns out that the `glob@10` types use `path-scurry@^1.11.1`, `minimatch@^9.0.4`, and `minipass@^7.1.2` -- all without flow type definitions. Writing the flow definitions for glob@9+ is non-trivial work, I'd be happy to help but I can't fix that on my own.

> [!IMPORTANT]
> `glob@11` has already been released, but it's only supporting Node 20+. I believe React Native still supports Node 18 until the EOL in April 2025, that's why I used `glob@10`.

## Changelog:

[GENERAL] [CHANGED] - Upgrade from deprecated `glob@7` to supported `glob@10`

<!-- Help reviewers and the release process by writing your own changelog entry.

Pick one each for the category and type tags:

[GENERAL] [CHANGED] - Upgrade from deprecated `glob@7` to supported `glob@10`

For more details, see:
https://reactnative.dev/contributing/changelogs-in-pull-requests

X-link: facebook/react-native#48875

Reviewed By: robhogan, cortinico

Differential Revision: D69594539

Pulled By: huntie
@cortinico cortinico mentioned this pull request May 21, 2025
Open
@react-native-bot
Copy link
Copy Markdown
Collaborator

react-native-bot commented Aug 24, 2025

This PR is stale because it has been open for 180 days with no activity. It will be closed in 7 days unless you comment on it or remove the "Stale" label.

@react-native-bot react-native-bot added the Stale There has been a lack of activity on this issue and it may be closed soon. label Aug 24, 2025
@react-native-bot
Copy link
Copy Markdown
Collaborator

react-native-bot commented Aug 31, 2025

This PR was closed because it has been stalled for 7 days with no activity.

@react-native-bot react-native-bot removed the Stale There has been a lack of activity on this issue and it may be closed soon. label Aug 31, 2025
@jvanes-awaze
Copy link
Copy Markdown

jvanes-awaze commented Sep 3, 2025

Any status update on this

@cortinico
Copy link
Copy Markdown
Contributor

cortinico commented Sep 3, 2025

cc @byCedric @huntie @robhogan

@robhogan robhogan reopened this Sep 3, 2025
@react-native-bot
Copy link
Copy Markdown
Collaborator

react-native-bot commented Sep 3, 2025


Warnings
⚠️ ❗ JavaScript API change detected - This PR commits an update to ReactNativeApi.d.ts, indicating a change to React Native's public JavaScript API. Please include a clear changelog message. This change will be subject to extra review.

This change was flagged as: BREAKING

Generated by 🚫 dangerJS against cef4f1c

@huntie
Copy link
Copy Markdown
Member

huntie commented Sep 4, 2025

Blocked by internal infra / dep alignment; gave up on this for now and needs a fresh reattempt.

@Lionhunt3r
Copy link
Copy Markdown

Lionhunt3r commented Sep 25, 2025

Is there another PR or issue where it is also being tracked or is this an actual tracker of the issue?

@cortinico
Copy link
Copy Markdown
Contributor

cortinico commented Sep 25, 2025

Nope that's the latest we have on this effort @Lionhunt3r

@Lionhunt3r
Copy link
Copy Markdown

Lionhunt3r commented Nov 3, 2025

@cortinico Can you please follow up on this issue? This would be great to get it solved.

@byCedric
Copy link
Copy Markdown
Contributor Author

byCedric commented Nov 20, 2025

With the new security notices going out for glob we probably want to get this unblocked and updated to v12 asap.

@nyur321
Copy link
Copy Markdown

nyur321 commented Nov 23, 2025

This is a security vulnerability flagged by Checkmarx, bumping on this issue

This was referenced Nov 26, 2025
Closed
Closed
meta-codesync Bot pushed a commit that referenced this pull request Dec 3, 2025
@kitten @meta-codesync
Replace glob@^7.0.0 with tinyglobby@^0.2.15 (#54737)
41eace0 
Summary:
This replaces `glob@^7.0.0` with `tinyglobby@^0.2.15`. `glob@7` has been deprecated for a while and some versions after had security notices released for them. The plan is to backport this PR to `0.81.x` and onwards.

> [!NOTE]
> This is a stopgap solution until `fs.glob` becomes generally available with the EOL of Node v20

Succeeds:
- #54669
- #48875

## Changelog:

[GENERAL] [SECURITY] - Replace `glob@^7.0.0` with `tinyglobby@^0.2.15`

Pull Request resolved: #54737

Test Plan:
- Ran all modified commands manually and `pod install in `rn-tester`
- NOTE: `ios-prebuild`-related scripts haven't been run manually yet

Reviewed By: robhogan

Differential Revision: D88069145

Pulled By: huntie

fbshipit-source-id: 0c455342a4c6d1d6605fd09fe47b418e5d751491
@react-native-bot
Copy link
Copy Markdown
Collaborator

react-native-bot commented May 23, 2026

This PR is stale because it has been open 180 days with no activity. Remove stale label or comment or this will be closed in 7 days.

@react-native-bot react-native-bot added the Stale There has been a lack of activity on this issue and it may be closed soon. label May 23, 2026
@huntie
Copy link
Copy Markdown
Member

huntie commented May 23, 2026

Resolved in #54737.

@huntie huntie closed this May 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@robhogan robhogan Awaiting requested review from robhogan

@huntie huntie Awaiting requested review from huntie

Assignees

@huntie huntie

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. p: Expo Partner: Expo Partner Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team. Stale There has been a lack of activity on this issue and it may be closed soon.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

9 participants

@byCedric @cortinico @huntie @facebook-github-bot @react-native-bot @jvanes-awaze @Lionhunt3r @nyur321 @robhogan