build(deps): bump the expo group with 9 updates

[dependabot]

Bumps the expo group with 9 updates:

Package	From	To
expo	57.0.18	57.0.19
expo-asset	57.0.15	57.0.16
expo-constants	57.0.16	57.0.17
expo-dev-client	57.0.16	57.0.18
expo-image-manipulator	57.0.14	57.0.15
expo-location	57.0.14	57.0.15
expo-sharing	57.0.16	57.0.17
react	19.2.3	19.2.8
react-native	0.86.3	0.87.1

Updates expo from 57.0.18 to 57.0.19

Commits

• See full diff in compare view

Updates expo-asset from 57.0.15 to 57.0.16

Commits

• See full diff in compare view

Updates expo-constants from 57.0.16 to 57.0.17

Commits

• See full diff in compare view

Updates expo-dev-client from 57.0.16 to 57.0.18

Commits

• See full diff in compare view

Updates expo-image-manipulator from 57.0.14 to 57.0.15

Commits

• See full diff in compare view

Updates expo-location from 57.0.14 to 57.0.15

Commits

• See full diff in compare view

Updates expo-sharing from 57.0.16 to 57.0.17

Commits

• See full diff in compare view

Updates react from 19.2.3 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

19.2.4 (January 26th, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #36566)

19.2.6 (May 6, 2026)

React Server Components

• Type hardening and performance improvements (@​eps1lon, @​unstubbable #36425)

19.2.5 (March 18, 2026)

React Server Components

• Add more cycle protections (@​eps1lon, @​unstubbable #36236)

19.2.4 (Jan 26, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (@​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable #35632)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• 6117d7c Version 19.2.7 (#36591)
• eaf3e95 Version 19.2.6
• 23f4f9f 19.2.5
• 90ab3f8 Version 19.2.4
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

Updates react-native from 0.86.3 to 0.87.1

Release notes

Sourced from react-native's releases.

0.87.1

Added

iOS specific

• SwiftPM: Added hard fail and clear error message when an autolinking plugin host is referenced as a dependency (90a539c92d by @​chrfalch)

Changed

• Hermes: Bump hermes-v1 to 250829098.0.17 (861e2d0bde by @​cipolleschi)

Fixed

• Animated: Animated.Value.addListener() types its callback payload as {value: number} rather than any (3eab03df4c by @​huntie)
• Animated: Animated.event() is typed as an event handler rather than any (3eb330a365 by @​huntie)

iOS specific

• Cocoapods: Keep the quotes on header search paths containing spaces in add_rn_third_party_dependencies (71c6bfbfdc by @​Kudo)
• SwiftPM: Reject colliding or invalid spm.modules names instead of silently dropping a module from the build (39cd1dfc4c by @​chrfalch)
• SwiftPM: Resolve Swift manifest naming collisions (962aeec5e5 by @​chrfalch)
• SwiftPM: Fixed not reading spm.name from react-native.config.js when scaffolding the Swift manifest (482acee824 by @​chrfalch)
• SwiftPM: Removed unused field spm.modules.publicHeaderFiles from react-native.config.js's spm section (5168f5f831 by Christian Falch)
• SwiftPM: SwiftPM pipeline now reads react-native.config.js with default exports correctly (ed76640ba6 by @​chrfalch)
• SwiftPM: Created constants for internal SwiftPM packages so that we can create guards to avoid collisions (d36aa4961d by @​chrfalch)
• SwiftPM: Set SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG when injecting SPM (4433cdbe62 by @​radoslawrolka)
• SwiftPM: Recover React-Core-prebuilt configuration swaps that were interrupted before the marker was updated (a772a7ca16 by @​adityasingh2400)
• SwiftPM: Fix Hermes runtime/compiler version mismatch causing "Wrong bytecode version" crashes in SwiftPM Release builds (ead93778a1 by @​nduaarte)

---

Hermes V1 dSYMS:

• Debug
• Release

ReactNativeDependencies dSYMs:

• Debug
• Release

ReactNative Core dSYMs:

• Debug
• Release

---

You can file issues or pick requests against this release here.

---

... (truncated)

Changelog

Sourced from react-native's changelog.

v0.87.1

Added

iOS specific

• SwiftPM: Added hard fail and clear error message when an autolinking plugin host is referenced as a dependency (90a539c92d by @​chrfalch)

Changed

• Hermes: Bump hermes-v1 to 250829098.0.17 (861e2d0bde by @​cipolleschi)

Fixed

• Animated: Animated.Value.addListener() types its callback payload as {value: number} rather than any (3eab03df4c by @​huntie)
• Animated: Animated.event() is typed as an event handler rather than any (3eb330a365 by @​huntie)

iOS specific

• Cocoapods: Keep the quotes on header search paths containing spaces in add_rn_third_party_dependencies (71c6bfbfdc by @​Kudo)
• SwiftPM: Reject colliding or invalid spm.modules names instead of silently dropping a module from the build (39cd1dfc4c by @​chrfalch)
• SwiftPM: Resolve Swift manifest naming collisions (962aeec5e5 by @​chrfalch)
• SwiftPM: Fixed not reading spm.name from react-native.config.js when scaffolding the Swift manifest (482acee824 by @​chrfalch)
• SwiftPM: Removed unused field spm.modules.publicHeaderFiles from react-native.config.js's spm section (5168f5f831 by Christian Falch)
• SwiftPM: SwiftPM pipeline now reads react-native.config.js with default exports correctly (ed76640ba6 by @​chrfalch)
• SwiftPM: Created constants for internal SwiftPM packages so that we can create guards to avoid collisions (d36aa4961d by @​chrfalch)
• SwiftPM: Set SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG when injecting SPM (4433cdbe62 by @​radoslawrolka)
• SwiftPM: Recover React-Core-prebuilt configuration swaps that were interrupted before the marker was updated (a772a7ca16 by @​adityasingh2400)
• SwiftPM: Fix Hermes runtime/compiler version mismatch causing "Wrong bytecode version" crashes in SwiftPM Release builds (ead93778a1 by @​nduaarte)

v0.87.0

Breaking

• Appearance: Fix return type of useColorScheme() hook (now ColorSchemeName | null) (ef6463c25d by @​huntie)
• Appearance: useColorScheme() no longer returns 'unspecified' (this was always the case, but is a breaking type change) (8ac88f481a by @​huntie)
• CLI: The react-native/core-cli-utils package is no longer published. It remains available in the React Native repo as a reference implementation. (9c3fddf9cd by @​huntie)
• Hermes: Remove Legacy Hermes from C++ code (f9476256bd by @​cipolleschi)
• JavaScript API: Deep imports to 'react-native/src/private/...' have been restricted, and are no longer visible to TypeScript. These subpaths still exist, but do not have type coverage. (142b6172a9 by @​huntie)
• JavaScript API: The NativeDialogManagerAndroid export is removed. (a793d21a7e by @​huntie)
• JavaScript API: The Touchable root export (undocumented) is removed. If you are extending Touchable as a type, please use ViewProps instead. (6fbf3062f9 by @​huntie)
• JavaScript API: react-native/rn-get-polyfills is removed — please use react-native/js-polyfills (package) (b6a535afee by @​huntie)
• Jest: react-native/jest-preset is removed — all projects must now migrate to react-native/jest-preset (package) (9ee21ddd9b by @​huntie)
• Legacy Architecture: Compile out RuntimeScheduler_Legacy under RCT_REMOVE_LEGACY_ARCH (d205267a5f by @​christophpurrer)
• LogBox: Set max font scaling in LogBox to avoid layout breaking (4aef2b0126 by @​pchalupa)
• Node: Require Node.js >= 22.13.0 (a0d39e7a9c by @​huntie)
• React Native DevTools: Remove support for connecting to the standalone react-devtools package via WebSocket. Use React Native DevTools instead. (f1971caa44 by @​huntie)
• Renderer: Remove RawPropsKey prefix and suffix (67381e157f by @​javache)
• Runtime: Remove the SceneTracker module from Libraries/Utilities, stop setting the active scene from AppRegistry.runApplication, and pass the app key as an optional second argument to WrapperComponentProvider (bbb5be9b41 by @​rubennorte)
• ScrollView: Remove deprecated boolean values support for ScrollView keyboardShouldPersistTaps (5bf3e38db2 by @​zoontek)

... (truncated)

Commits

• a59eff6 Release 0.87.1
• 1a6b526 [0.87] Regenerate ReactNativeApi snapshot with CI toolchain
• dda5dd3 [0.87] Regenerate ReactNativeApi snapshot
• 476887c Merge remote-tracking branch 'refs/remotes/origin/pr/58052' into 0.87-stable
• e6e404e Hold an app's spm.modules names to the same rules as a library's (#58060)
• c951129 Resolve SwiftPM manifest naming collisions (#58044)
• 33624ce Honor a library's spm.name when scaffolding its Package.swift (#58033)
• 617a82f Fail with clear error message when a dep depends on an autolinking plugin hos...
• 5e24a69 Drop the inert publicHeadersPath from spm.modules (#58059)
• 40af900 Read both export styles from a library's react-native.config.js (#58034)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.