Request to update CLI versions in template

[floydkim]

Hello.
I saw this tweet responding to the recently disclosed CVE-2025-11953.
It was addressed in the 20.0.2 release in September,
but the Template is still locked to version 20.0.0, so even after September, we haven’t been able to benefit from the security fix.

I ended up using version 20.0.0 through React Native Upgrade Helper without being aware of the security issue,
and I believe newly created projects via the CLI are likely in the same situation.

I think it’s important for the Templates to be updated as soon as possible.
Thank you, as always, for your hard work.

[floydkim]

But on GitHub it says 20.0.0 is the patched version. Exactly which version was it fixed in?

Edit:
I've checked that v20.0.0 includes the fix. react-native-community/cli@1508990

Is it possible to modify templates for older RN versions?
e.g. 0.79.7, 0.80.2

[cortinico]

Is it possible to modify templates for older RN versions?

Yes we should be able to do so. Are you up for sending PRs to help us bump it in the relevant branches?

[floydkim]

@cortinico sure.

But I have a question.
For example, let's say I want to modify the 0.80.2 template.
It seems like I should make changes to the 0.80-stable branch, but what should I do with the tag?
If developers use the following command to create a new project corresponding to RN 0.80.2, it seems like it will reference the 0.80.2 tag.
npx @react-native-community/cli init TestApp --version 0.80.2
Should I delete the existing 0.80.2 tag and then create a new 0.80.2 tag that points to the commit added to the 0.80-stable branch?

Ah, but tags aren’t something I can handle anyway.
Should I just create PRs for the 0.80-stable and 0.79-stable branches?

[cortinico]

It seems like I should make changes to the 0.80-stable branch, but what should I do with the tag?

Tag should not be changed. We should just update the 0.80-stable and 0.79-stable branches.
Once we release a new 0.79 or 0.80 point release, the release process will take care of creating a new tag for the template as well