React Native in workspaces: Start with oauth-cross-platform/mobile [1/N]

[janjakubnanista]

Summary & Motivation

Until now we kept the react-native examples out of the pnpm workspaces. This PR:

• Modifies TurnkeyProvider in @turnkey/react-native-wallet-kit so that it does not depend on react-native-device-info (incompatible with expo). This is a backwards-compatible change as it only adds an optional property. Missing devDependencies have also been added, just as a little cleanup (until now the package would rely on these implicitly)
• Updates expo & Runs npx expo-doctor in oauth-cross-platform/mobile
• Adds typecheck command and fixes some smaller issues
• Fixes a new security vulnerability
• Fixes build errors that popped up once the examples were plugged in
• Fixes jest config errors that popped up once the examples were plugged in

How I Tested These Changes

Locally on an iOS simulator + CI for typecheck

Did you add a changeset?

Yes, to @turnkey/react-native-wallet-kit

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	metro-cache@​0.84.4
	@​react-native/​metro-config@​0.86.0
	expo-status-bar@​56.0.4
	expo-system-ui@​56.0.5
	@​react-native/​jest-preset@​0.86.0
	expo-constants@​56.0.18
	expo-linking@​8.0.12 ⏵ 56.0.14	+1		+1	+1
	expo-font@​14.0.12 ⏵ 56.0.6			+1
	expo@​54.0.35 ⏵ 56.0.11			+23
	expo-web-browser@​15.0.11 ⏵ 56.0.5				+1
	expo-splash-screen@​56.0.10
	react-native-safe-area-context@​5.7.0
	react-native-gesture-handler@​2.31.2
	@​react-native/​babel-preset@​0.86.0
	react@​19.2.3
	react-native-worklets@​0.8.3
	eslint-config-expo@​56.0.4
	react-native-svg@​15.15.4
	react-native-reanimated@​4.3.1
	react-native-screens@​4.25.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @expo/cli is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@react-three/fiber@9.5.0 → npm/expo@56.0.11 → npm/@solana/wallet-adapter-wallets@0.19.37 → npm/@expo/cli@56.1.15 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@expo/cli@56.1.15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @react-native/debugger-frontend is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@react-three/fiber@9.5.0 → npm/@buildonspark/issuer-sdk@0.1.23 → npm/react-native@0.85.3 → npm/@buildonspark/spark-sdk@0.8.6 → npm/expo@56.0.11 → npm/react-native-passkey@3.0.0 → npm/@react-native-async-storage/async-storage@2.2.0 → npm/@solana/wallet-adapter-react@0.15.39 → npm/@solana/wallet-adapter-wallets@0.19.37 → npm/porto@0.2.19 → npm/wagmi@2.17.5 → npm/@react-native/debugger-frontend@0.85.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.85.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @react-native/debugger-frontend is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@react-three/fiber@9.5.0 → npm/@buildonspark/issuer-sdk@0.1.23 → npm/react-native@0.85.3 → npm/@buildonspark/spark-sdk@0.8.6 → npm/expo@56.0.11 → npm/react-native-passkey@3.0.0 → npm/@react-native-async-storage/async-storage@2.2.0 → npm/@solana/wallet-adapter-react@0.15.39 → npm/@solana/wallet-adapter-wallets@0.19.37 → npm/porto@0.2.19 → npm/wagmi@2.17.5 → npm/@react-native/debugger-frontend@0.85.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.85.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @typescript-eslint/eslint-plugin is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/eslint-config-expo@56.0.4 → npm/@typescript-eslint/eslint-plugin@8.61.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.61.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit 45bd9db:

Sandbox	Source
@turnkey/example-react-components	Configuration

[ethankonk]

This is looking super promising! Can't wait for this!

[ethankonk]

Curious why these new dev dependencies were added, do we use them in examples only? Why add them at the package level?

[ethankonk]

I don't believe this is breaking but anyone that does rely on passkey names being named based on their device app name will need to update their config with their app name.

Not a huge deal but is there a reason why react-native-device-info needs to be removed? Is that the package that blocks us from using @turnkey/react-native-wallet-kit in our workspace?

[janjakubnanista]

react-native-device-info does not play nice with expo - you would need to create a custom build for it to run (which is out of scope for an example that does not have a build step). Expo, in a managed workflow, uses expo-device rather than react-native-device-info. So removing this dependency not only fixes this issue but makes this code compatibility a bit wider

[ethankonk]

Will it be possible to remove with-react-native-wallet-kit from the workspace block with these changes as well? That would be amazing

[janjakubnanista]

Yeah I am going one by one though