The day I broke React Native

The release crew began preparing React Native 0.71 release candidate 0 on November 4, 2022. The release included a change to publish Android artifacts through Maven Central because the npm package had grown to about 130 MB and was approaching npm’s 200 MB limit.

Android projects and many React Native libraries used a plus sign as the dependency version, which lets Gradle select the highest version it can find. Moving the artifacts to Maven Central meant a newer published version could override the version bundled with an older React Native project. Corti calls this a ticking bomb that went unnoticed until the release.

Changing only an app’s dependency was insufficient because libraries such as Reanimated also declared dynamic React Native dependencies. Corti and the release crew shared a Gradle script to mitigate the issue, then published patch releases for versions down to 0.63, covering 99% of the market share at the time. Sonatype removed the problematic Maven Central artifacts, resolving the issue.

The team added safeguards to the React Native Gradle Plugin and established a support window focused generally on the latest three minor versions, which covered 75% of usage. Corti says the team was slow to escalate because it had no telemetry on community builds, and now also watches social platforms for reports. He also points to inconsistent library build scripts and plans to work with Callstack and the community on better library tooling guidance.

Corti’s advice is not to release on Friday, though in this case the weekend gave the team time to investigate and ship fixes before Monday. He also notes that airplane Wi-Fi made incident response harder. The team had attempted the release seven times over the week before it succeeded.