[serzmerz]

Summary

nativeFingerprint hashes the autolinking config, but that config carries only package names and paths. Native sources live under node_modules, which the fingerprint does not hash. Upgrading a native dependency therefore leaves the fingerprint unchanged, and the remote cache serves a build compiled from the previous version.

On iOS this is masked because ios/Podfile.lock changes with the dependency and is part of the hashed ios/ folder. Android has no equivalent lockfile under android/, so the stale cache hit goes unnoticed.

This PR adds the installed version of each autolinked dependency (read from its package.json) to the autolinkingSources input. A native dependency bump now changes the fingerprint on every platform. JS-only dependencies are not autolinked, so they still do not affect it.

How we hit it

In a React Native app using Rock 0.12.x we upgraded react-native-view-shot 4.0.3 → 6.1.1. rock fingerprint -p android was identical to main, the CI job reported success after a cache hit, and the downloaded APK still contained the 4.0.3 native code. Over 60 days, seven native dependency bumps merged without touching android/, each reusing a stale Android artifact.

The only config-level workaround is adding yarn.lock to fingerprint.extraSources, which also invalidates the cache for JS-only dependency changes. Paths under node_modules cannot be used in extraSources because gitignored paths are excluded by the hasher.

Changes

• parseAutolinkingSources reads <dependency root>/package.json and stores version next to root and platforms. A missing or unreadable package.json leaves version undefined, so such a dependency keeps its current behaviour.
• Test: the fingerprint changes when an autolinked dependency's version changes, and the hashed autolinkingSources input contains relative paths plus the version.
• Changeset: patch for @rock-js/tools.

Test plan

• pnpm vitest run packages/tools (13 passed)
• pnpm --filter @rock-js/tools build (typecheck)
• prettier --check and eslint on the changed files

🤖 Generated with Claude Code

[vercel]

@serzmerz is attempting to deploy a commit to the Callstack Team on Vercel.

A member of the Team first needs to authorize it.