chore(deps-dev): bump @react-native-community/cli-platform-ios from 18.0.0 to 20.2.0

[dependabot]

Bumps @react-native-community/cli-platform-ios from 18.0.0 to 20.2.0.

Release notes

Sourced from @​react-native-community/cli-platform-ios's releases.

v20.2.0

Changes

• fix: restore open-url browser links while respecting CVE-2025-11953 @​thymikee (#2814)
• fix(android): don't hardcode default cmakeListsPath for pure c++ modules @​satya164 (#2799)
• fix(android): respect --device on run-android when multiple devices connected @​janicduplessis (#2796)
• build(deps): bump fast-xml-parser from 5.3.6 to 5.5.7 @​dependabot (#2781)
• fix: always launches fallback simulator @​dannyhw (#2778)
• fix: ci e2e test snapshot drift @​dannyhw (#2779)
• [Android] Fix variantPath for multiflavored paths @​Reeywhaar (#2762)
• fix: fail when exact template version does not exist @​fabriziocucci (#2764)
• build(deps): bump fast-xml-parser from 4.4.1 to 5.3.4 @​dependabot (#2760)

🚀 Features

• feat: Support DeviceHub for Xcode 27+ @​huntie (#2806)

🐛 Bug Fixes

• fix(ios): never default to a connected device on plain run-ios @​azizbecha (#2795)
• fix(iOS): getBuildSettings picking up wrong target @​divyanshu-patil (#2801)
• fix: propagate resolved port to build when default port is unavailable @​janicduplessis (#2783)
• 🔒️ Bump fast-xml-parser to 5.3.6 due to CVE-2026-26278 @​Jamim (#2770)
• fix(tests): mock node:zlib @​azizbecha (#2761)
• fix: update snapshot of e2e tests @​thymikee (#2759)

🧰 Maintenance

• Revise README, symlink to main package @​huntie (#2807)
• docs: update compatibility table to include up to RN 0.85 @​alanleedev (#2777)

Full Changelog: react-native-community/cli@v20.1.1...v20.2.0

v20.1.1

What's Changed

• fix: prevent RCE in openURLMiddleware via URL sanitization by @​Copilot and @​huntie in react-native-community/cli#2758

New Contributors

• @​Copilot made their first contribution in react-native-community/cli#2758

Full Changelog: react-native-community/cli@v20.1.0...v20.1.1

v20.1.0

What's Changed

• [fix] Support Android Studio path that JetBrains Toolbox installs to on Windows by @​matthargett in react-native-community/cli#2682
• chore(cli): Update macOS / windows docs links by @​Saadnajmi in react-native-community/cli#2714
• Return to less intrusive way of starting server in a new window on macOS by @​swrobel in react-native-community/cli#2715
• Fix plistPath when using a prebuilt binary (appPath) by @​jenskuhrjorgensen in react-native-community/cli#2705
• Feature: Remove hardcoded index when selecting the correct build target by @​jenskuhrjorgensen in react-native-community/cli#2707
• Fix destination in buildProject by @​jenskuhrjorgensen in react-native-community/cli#2706

... (truncated)

Commits

• 9013a48 v20.2.0 (#2813)
• 04bd056 v20.1.3
• f961930 v20.1.2
• 2eb9e44 v20.1.1
• 24f026e v20.1.0
• 7c8951c v20.0.2
• d9ee06a v20.0.1
• eea99b9 v20.0.0
• e2888d2 v20.0.0-alpha.2
• 0bfd21f v20.0.0-alpha.1
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
drafto	Ready	Preview	Aug 3, 2026 10:08pm

[JakubAnderwald]

Nightly dependency review — major version bump flagged for manual review.

CI is fully green on this PR, but this is a major bump (18 → 20) crossing two majors, so per policy I'm flagging rather than auto-merging.

• Package: @react-native-community/cli-platform-ios, 18.0.0 → 20.2.0 — dev dependency (devDependencies) in apps/desktop/package.json:45. Not imported in any source file; it's a build/CLI plugin invoked by @react-native-community/cli for iOS build/run commands.

• Breaking changes relevant to this codebase: None directly exercised. The desktop app builds macOS via react-native run-macos (apps/desktop/package.json:8), not iOS, so this iOS platform plugin is off the critical build path. The v20 iOS behavior changes never run in our workflow. CI confirms: Desktop Checks, Mobile Checks, E2E, Lint & Typecheck, and Unit/Integration all pass.

• Breaking changes NOT relevant (iOS-only, we don't run them):

  • "never default to a connected device on plain run-ios" (#2795) — we use run-macos.
  • Xcode 27 DeviceHub support (#2806), getBuildSettings target fix (#2801), fallback-simulator launch (#2778) — iOS simulator/device tooling, unused here.
  • Security-positive: RCE fix in openURLMiddleware (CVE-2025-11953, v20.1.1) and fast-xml-parser CVE bumps — dev-tooling hardening, no downside.

• Peer dependency impacts: ⚠️ The real concern. apps/desktop pins both @react-native-community/cli@18.0.0 (:44) and @react-native-community/cli-platform-ios@18.0.0 (:45), and react-native@0.86.0 / react-native-macos@0.81.7 both resolve @react-native-community/cli@18.0.0 throughout the lockfile. This PR bumps only the iOS plugin to 20.2.0, leaving the main CLI at 18 — a version skew within a single monorepo family that is meant to be version-aligned. pnpm resolves it and CI passes, but the two are designed to move together.

• Recommendation: Low functional risk to merge as-is (dev-only tool, off the macOS build path, CI green), but the cleaner action is to keep the CLI family aligned rather than merge a lone-plugin skew. Preferred options for the reviewer:

  1. Close/hold this PR and instead bump the whole @react-native-community/cli* family (incl. @react-native-community/cli@18→20) together to match, or
  2. Merge as-is if you want the security fixes now and are comfortable with the temporary 18/20 skew (no user-facing impact — dev tooling only).