@rnx-kit/cli 0.18.13 → 0.18.14

package/lib/bundle/hermes.js

@@ -117,9 +117,6 @@ function emitBytecode(cliConfig, input, sourcemap, options) {
         const options = { encoding: "utf-8" };
         const packagerSourcemap = JSON.parse(fs.readFileSync(sourcemap, options));
         const compilerSourcemap = JSON.parse(fs.readFileSync(outputMap, options));
-        // `composeSourceMaps` was introduced in 0.56 — see
-        // https://github.com/facebook/metro/commit/6017085bdad96ca5cec39d50038eb5622ce1097b
-        // @ts-expect-error Property 'composeSourceMaps' does not exist
         const { composeSourceMaps } = (0, metro_1.requireModuleFromMetro)("metro-source-map");
         const composed = composeSourceMaps([packagerSourcemap, compilerSourcemap]);
         (0, tools_filesystem_1.writeJSONFile)(outputMap, composed, 0);

package/lib/helpers/externals.js

@@ -37,15 +37,12 @@ exports.requireExternal = requireExternal;
 const package_1 = require("@rnx-kit/tools-node/package");
 const context_1 = require("@rnx-kit/tools-react-native/context");
 const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
 function friendlyRequire(modules, startDir) {
     const target = modules.pop();
     if (!target) {
         throw new Error("At least one target module is required");
     }
-    const resolvedStartDir = fs.lstatSync(startDir).isSymbolicLink()
-        ? path.resolve(path.dirname(startDir), fs.readlinkSync(startDir))
-        : startDir;
+    const resolvedStartDir = fs.realpathSync(startDir);
     try {
         const finalPackageDir = (0, package_1.resolveDependencyChain)(modules, resolvedStartDir);
         const targetModule = require.resolve(target, { paths: [finalPackageDir] });

package/lib/helpers/metro-config.js

@@ -140,7 +140,7 @@ function customizeMetroConfig(metroConfigReadonly, extraParams, print) {
         metroConfig.serializer.customSerializer = (0, metro_serializer_1.MetroSerializer)(metroPlugins);
     }
     else {
-        // @ts-expect-error We don't want this set if unused
+        // We don't want this set if unused
         delete metroConfig.serializer.customSerializer;
     }
     const hooks = Object.values(serializerHooks);

package/lib/index.d.ts

@@ -1,4 +1,5 @@
 import type { Command } from "@react-native-community/cli-types";
+import { writeThirdPartyNoticesCommand } from "@rnx-kit/third-party-notices";
 import { rnxBuild, rnxBuildCommand } from "./build";
 import { rnxBundle, rnxBundleCommand } from "./bundle";
 import { rnxClean, rnxCleanCommand } from "./clean";
@@ -25,25 +26,6 @@ export declare const rnxAlignDepsCommand: {
         description: string;
     }[];
 };
-export declare const rnxWriteThirdPartyNotices: (_argv: string[], _config: import("@react-native-community/cli-types").Config, { additionalText, fullLicenseText, ignoreModules, ignoreScopes, json, outputFile, preambleText, rootPath, sourceMapFile, }: import("@rnx-kit/third-party-notices/lib/types").WriteThirdPartyNoticesOptions & {
-    ignoreScopes?: string;
-    ignoreModules?: string;
-    preambleText?: string;
-    additionalText?: string;
-}) => void;
-export declare const rnxWriteThirdPartyNoticesCommand: {
-    name: string;
-    description: string;
-    func: (_argv: string[], _config: import("@react-native-community/cli-types").Config, { additionalText, fullLicenseText, ignoreModules, ignoreScopes, json, outputFile, preambleText, rootPath, sourceMapFile, }: import("@rnx-kit/third-party-notices/lib/types").WriteThirdPartyNoticesOptions & {
-        ignoreScopes?: string;
-        ignoreModules?: string;
-        preambleText?: string;
-        additionalText?: string;
-    }) => void;
-    readonly options: {
-        name: string;
-        description: "The root of the repo to start resolving modules from" | "The source map file to generate license contents for" | "Output license information as a JSON" | "The output file to write the license file to" | "npm scopes to ignore and not emit license information for" | "Modules (JS packages) to not emit license information for" | "A list of lines to prepend at the start of the generated license file" | "A list of lines to append at the end of the generated license file" | "Include full license text in the JSON output";
-        default: string | false | undefined;
-    }[];
-};
+export declare const rnxWriteThirdPartyNotices: typeof writeThirdPartyNoticesCommand.func;
+export declare const rnxWriteThirdPartyNoticesCommand: typeof writeThirdPartyNoticesCommand;
 //# sourceMappingURL=index.d.ts.map

package/lib/serve/keyboard.js

@@ -43,9 +43,7 @@ const path = __importStar(require("node:path"));
 const node_readline_1 = __importDefault(require("node:readline"));
 const qrcode_1 = __importDefault(require("qrcode"));
 function createOpenDebuggerKeyboardHandler({ devServerUrl, metroTerminal: { reporter }, reactNativePath, }) {
-    const resolvedPath = fs.lstatSync(reactNativePath).isSymbolicLink()
-        ? path.resolve(path.dirname(reactNativePath), fs.readlinkSync(reactNativePath))
-        : reactNativePath;
+    const resolvedPath = fs.realpathSync(reactNativePath);
     try {
         // Available starting with 0.76
         const cliPlugin = require.resolve("@react-native/community-cli-plugin/package.json", { paths: [resolvedPath] });

package/lib/start.js

@@ -58,6 +58,11 @@ async function rnxStart(_argv, ctx, args) {
             logger.warn("Interactive mode is not supported in this environment");
         }
     }
+    // CVE-2025-11953: Ensure `host` is set to `localhost` by default, otherwise
+    // it will listen to external connections.
+    if (!args.host) {
+        args.host = "127.0.0.1";
+    }
     // load Metro configuration, applying overrides from the command line
     const metroConfig = await (0, metro_service_1.loadMetroConfig)(ctx, {
         ...args,
@@ -93,7 +98,7 @@ async function rnxStart(_argv, ctx, args) {
     }
     // create middleware -- a collection of plugins which handle incoming
     // http(s) requests, routing them to static pages or JS functions.
-    const host = args.host?.length ? args.host : "localhost";
+    const host = args.host;
     const devServerUrl = `${scheme}://${host}:${port}`;
     const devServer = createDevServerMiddleware({ host, port, watchFolders });
     const coreDevMiddleware = (() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rnx-kit/cli",
-  "version": "0.18.13",
+  "version": "0.18.14",
   "description": "Command-line interface for working with kit packages in your repo",
   "homepage": "https://github.com/microsoft/rnx-kit/tree/main/packages/cli#readme",
   "license": "MIT",
@@ -47,7 +47,7 @@
     "@rnx-kit/metro-plugin-duplicates-checker": "^3.0.0",
     "@rnx-kit/metro-plugin-typescript": "^0.5.0",
     "@rnx-kit/metro-serializer": "^2.0.0",
-    "@rnx-kit/metro-serializer-esbuild": "^0.2.1",
+    "@rnx-kit/metro-serializer-esbuild": "^0.2.6",
     "@rnx-kit/metro-service": "^4.0.2",
     "@rnx-kit/third-party-notices": "^2.0.0",
     "@rnx-kit/tools-android": "^0.2.1",