Skip to content

chore(deps): bump appium platform drivers to Appium 3 majors - #162

Closed
julianrojas9920 wants to merge 2 commits into
AppiumTestDistribution:mainfrom
julianrojas9920:chore/bump-appium-drivers
Closed

julianrojas9920 wants to merge 2 commits into
AppiumTestDistribution:mainfrom
julianrojas9920:chore/bump-appium-drivers

Conversation

@julianrojas9920

Copy link
Copy Markdown

What

Bump the pinned appium platform-driver ranges to their current Appium 3 majors:

  • appium-uiautomator2-driver ^5.0.0 → ^7.0.0
  • appium-xcuitest-driver ^10.0.0 → ^11.0.0
  • appium-mac2-driver ^3.0.0 → ^4.0.0

Why

The ^5/^10/^3 lines resolve to old driver builds whose bundled npm-shrinkwrap.json pins a stale transitive stack that Dependabot flags in downstream projects — notably:

  • @appium/support Zip Slip (<= 7.0.5, critical)
  • shell-quote (critical)
  • plus @xmldom/xmldom, minimatch, glob, lodash, axios, form-data, path-to-regexp (high)

Consumers can't override these away (npm overrides don't penetrate a dependency's shrinkwrap). Bumping the pinned majors here lets the driver ride the current Appium 3 driver releases, which carry the upstream security patches.

Compatibility

Verified runtime-compatible: built the instrumented app and ran a full login E2E (email/OTP/PIN → home) green on Android with appium-uiautomator2-driver@7.6.2 + appium-xcuitest-driver@11.13.0 forced into the driver — no API breakage observed at the driver boundary.

Note: this only bumps the declared ranges; happy to follow up with a lockfile/CI update if the maintainers prefer.

julianrojas9920 and others added 2 commits July 21, 2026 08:38
uiautomator2-driver ^5->^7, xcuitest-driver ^10->^11, mac2-driver ^3->^4.
The pinned ^5/^10/^3 lines pull a stale transitive stack (shell-quote 1.8.3, @appium/support 7.0.2 Zip Slip, xmldom, minimatch, glob, lodash) flagged by Dependabot. These majors align with current Appium 3 releases and pick up upstream security patches.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The version-range bump alone broke the TS build because the newer drivers
use @appium/types 1.x (adds maxIpcDataSize/maxIpcTopics on InitialOpts) while
the driver pinned @appium/types ^0.x. This aligns the toolchain so `npm run
build` compiles clean:

- @appium/types ^0.x -> ^1.5.1 (match @appium/base-driver@10)
- add @appium/tsconfig devDep (extended by tsconfig but resolved only transitively)
- tsconfig: skipLibCheck (avoid type-checking mismatched dep .d.ts)
- driver.ts: coalesce sessionId null -> undefined for deleteSession
- macOS.ts: cast createSession spread (new base-driver arity)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@julianrojas9920

Copy link
Copy Markdown
Author

Status update, and closing this out.

Bumping the platform-driver ranges to the Appium 3 majors (uiautomator2 ^7, xcuitest ^11, mac2 ^4) turned out to need more than a version bump — it's a port to the new driver APIs, not a dependency change.

What I pushed on this branch (compiles now):

  • The naive range bump broke the TS build (the newer drivers use @appium/types 1.x, which adds maxIpcDataSize/maxIpcTopics on InitialOpts, while this package pinned @appium/types ^0.x).
  • Fixed it: aligned @appium/types 0.x -> ^1.5.1, added @appium/tsconfig as an explicit devDep (it's extends-ed but was only resolved transitively), skipLibCheck, and two source fixes (driver.ts sessionId null->undefined; macOS.ts InitialOpts/createSession spread). npm run build is clean.

What's still needed (why I'm not landing it):

  • Unit tests fail because appium-mac2-driver@4 changed its package exports (ESM), so the imports in src/utils.ts need porting; E2E untested. It's a real modernization to the new majors.

Closing since it can't go in as a small change. Leaving the branch (julianrojas9920:chore/bump-appium-drivers, latest 216bcca) as a starting point if a maintainer wants to continue. Context: consumers can't override the stale transitive stack away (npm overrides don't penetrate the sub-drivers' shrinkwrap), so a driver-side bump is the only real fix. Thanks for the driver!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant