Should we release 0.70.15?

[lunaleaps]

Released. The 0.70.15 is the latest patch for 0.70 the release crew will prepare as, with the release of 0.73.0, version 0.70 exited the support window.

Current Release: 0.70.14

Conversations on this thread are limited:

• major release issues.
• qualified cherry-pick requests of commits on main that did not make the previous patch version.

Please include a link to the specific commit on main to be cherry-picked, for example: facebook/react-native@bd2b7d6

In other words, if you cannot point to a particular commit on main, then your request likely belongs as a new issue.
If the issue is a major release issues, please reference the issue here.

---

List of qualified picks

Local commits to backport to main

[cipolleschi]

Merge: facebook/react-native#41278 or you can't release as CI can't be green.

[lunaleaps]

This was closed, I'm guessing we don't need this anymore @cipolleschi?

[lunaleaps]

Another q, I see we have a pick request for facebook/react-native@479b4bb for 0.72, wondering if that should go in this too.

I do see our ios test failing like so but it doesn't seem related https://app.circleci.com/pipelines/github/facebook/react-native/38736/workflows/c7324285-467a-48c3-a9f6-fc4aaabc2b4c/jobs/1281830

[erinleigh90]

Can we backport facebook/react-native@462d93d to 0.70.15? (Removes the [email protected] dependency which has been flagged as vulnerable)

[lunaleaps]

I see that 0.70 has already been bumped:
https://github.com/facebook/react-native/blob/cb170efdd346776aa6941512e1c23eb11c3f0a3a/packages/react-native-codegen/package.json#L23C6-L23C10
https://github.com/facebook/react-native/blob/0.70-stable/repo-config/package.json#L41

[AllanZhengYP]

Can we backport the react-devtools-core dependency upgrade(facebook/react-native@d3e8b64) to 0.70? It is causing depandabot alert

[lunaleaps]

What's the vulnerability that dependabot is sharing? What release fixes the vulnerability, why 4.27.7 specifically?
https://github.com/facebook/react/blob/3e00e58a6ac7f73a3660f31d3129fb06d344167e/packages/react-devtools/CHANGELOG.md
or maybe better to just look at react-devtools-core https://github.com/facebook/react/commits/main/packages/react-devtools-core?before=3e00e58a6ac7f73a3660f31d3129fb06d344167e+35

[liamjones]

Oops, I forgot 0.70 was still in support too...

It was suggested that the webp vulnerability patched in Fresco should probably be backported to supported versions of RN - just adding a note here for reference: react-native-community/discussions-and-proposals#725 (comment)

[lunaleaps]

It was decided to not backport this as its a major version upgrade and the advice is to upgrade to 0.73. Please keep the discussion on react-native-community/discussions-and-proposals#725

[hurali97]

Need to merge this PR for CLI bump: facebook/react-native#41479

[lunaleaps]

✅ picked

[cortinico]

headsup: with the release of 0.73.0, this minor (0.70) now moves into unsupported status, so don't expect further releases to be done. Check out the release policy for more details.