added mobile to docker#406
Open
paribaker wants to merge 2 commits into
Open
Conversation
whusterj
force-pushed
the
feature/docker-mobile
branch
from
8a6b689 to
e3738c3
Compare
## Problem `feature/docker-mobile` introduced a mobile Docker image pinned to Node 18, while most of the repository and template CI paths were already on Node 22 and mobile docs referenced Node 20. This created version drift across local development, Docker, CI, and generated template projects. From a developer perspective, this mismatch can produce inconsistent install/lint/build behavior depending on where commands run (host machine vs Docker vs GitHub Actions), and it increases maintenance cost when troubleshooting environment-specific issues. ## Root Cause Node runtime declarations were maintained in multiple places (Dockerfiles, GitHub workflows, docs, template engine constraints, and local GitHub action runtime metadata), and those references evolved independently over time. ## Fix This PR aligns runtime declarations to a single canonical target of **Node 22.x** for project/tooling execution, and removes stale/deprecated runtime references: - Updated mobile Docker image to `node:22-alpine`. - Standardized `actions/setup-node` references to `22.x` where mixed formats (`22`, `'22'`, `22.x`) were present. - Updated template mobile README from Node 20 guidance to Node 22 guidance. - Normalized template root engine constraints from `22.*.*`/`10.*.*` to `22.x`/`10.x`. - Updated local JavaScript GitHub Action runtime from `node16` to `node20` (required because GitHub Actions JS runtimes are versioned separately from project runtime and `node16` is deprecated). ## Validation Ran the following checks in the worktree: - `UV_CACHE_DIR=.uv-cache uv run ruff check .` ✅ - `UV_CACHE_DIR=.uv-cache uv run pytest tests/test_cookiecutter_generation.py` ✅ (`7 passed, 1 skipped`) - Repo-wide grep audit for stale references (`node:18`, `node-version: 18/20`, `Node v20`, `using: 'node16'`) ✅ no matches ## Compatibility Notes / Risks The template web lockfile currently includes at least one dependency constraint requiring `^20.19.0 || >=22.12.0`. Using `22.x` remains correct, but CI/dev images should not pin to early Node 22 patch versions lower than `22.12.0`. ## Scope Only Node version alignment files were changed (9 files total), with no application logic changes.
whusterj
added a commit
that referenced
this pull request
Mar 19, 2026
## Summary Bumps JS dependencies in the web (React) and mobile (React Native) templates to resolve open Dependabot security alerts. Most were transitive dependencies updated via `npm update`; overrides were added where semver constraints prevented natural resolution. ## Alerts resolved - **flatted** 3.3.3 → 3.4.2 — prototype pollution + unbounded recursion DoS (alerts #429, #428, #417) - **ajv** 6.12.6 → 6.14.0 — ReDoS with `$data` option (alerts #412, #411) - **minimatch** 3.x (3.1.2 → 3.1.5) and 9.x (9.0.5 → 9.0.9) — ReDoS (alerts #407, #403) - **serialize-javascript** 6.0.2 → 7.0.4 via override — RCE via `RegExp.flags` (alerts #406, #405) - **zod** (React Native) 3.21.4 → 3.25.76 — denial of service (alert #427) ## Approach - `serialize-javascript` pinned via `overrides` in both `package.json` files (transitive dep of webpack-related tooling) - `zod` bumped as a direct dependency in the RN template - `@typescript-eslint/utils` minimatch pinned via override in the RN template - All lock files regenerated with `npm install`
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds Docker support for the React Native mobile client, enabling containerized development environment for mobile app development.
Changes
compose/mobile/Dockerfile)Benefits