nativekeel 0.1.16 → 0.1.17

package/README.md

@@ -6,7 +6,7 @@ Health check for React Native and Expo apps. One command, no install, no account
 npx nativekeel
 ```
 
-**What's new in 0.1.16:** deep-link checks: unverified Android App Links, and the template `myapp://` scheme that other apps can claim (MASVS-PLATFORM). **0.1.15:** run it at a monorepo root and it lists the app folders to scan. **0.1.14:** secrets in Expo config (`extra`, `EXPO_PUBLIC_`, `eas.json`) and imports of APIs removed from React Native core. Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 450+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
+**What's new in 0.1.17:** every vulnerable package shows the version that fixes it, and Expo apps get one line for the packages the SDK upgrade moves instead of a long list. **0.1.16:** deep-link checks: unverified Android App Links, and the template `myapp://` scheme that other apps can claim (MASVS-PLATFORM). Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 450+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
 
 ```
 Summary  4 critical · 5 high · 4 medium · 6 low

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nativekeel",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Health check for React Native and Expo apps: upgrade blockers, store deadlines, crash risks, vulnerable dependencies and leaked secrets, with a step-by-step upgrade plan.",
   "type": "module",
   "bin": {

package/src/analyze.js

@@ -8,6 +8,7 @@ import { stabilityChecks } from './stability.js';
 import { performanceChecks } from './performance.js';
 import { vulnerableDependencies, passwordLeaks, webViewRisks, androidBackup, exportedComponents, plainHttpCalls, cloudRules, insecureTls, weakCrypto, tokenStorage, reverseEngineering, expoConfigSecrets, deepLinks, masvsOf, MASVS_GROUPS } from './security.js';
 import { lockedVersions } from './lockfile.js';
+import { expoPinnedNames, movesWithExpoSdk } from './expo-pins.js';
 import { findUnused, filesImportingWith } from './usage.js';
 import { matchKnownIssues, compareVersions } from './known-issues.js';
 import { COMPAT, bestRange, checkCompat } from './compat.js';
@@ -232,6 +233,8 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
   const codegen = forcedOffline ? {} : await registry.codegenSupport(archSuspects.map((n) => ({ name: n, version: versionOf(n) })));
 
   const deps = [];
+  let pinnedCache = null;
+  const expoPinned = () => (pinnedCache ||= expoPinnedNames(project.root));
   for (const name of names) {
     const dir = directory[name];
     const version = versionOf(name);
@@ -296,13 +299,15 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
       });
     }
     if (!noNewArch && !dep.unmaintained && !stale && version && dep.latest && lineOf(version) !== lineOf(dep.latest)) {
+      // In Expo apps the SDK decides these versions: the SDK upgrade moves them, no separate work.
+      const expoManaged = !!project.expoVersion && movesWithExpoSdk(name, expoPinned());
       add({
         id: `dep-major:${name}`,
-        severity: 'low',
+        severity: expoManaged ? 'info' : 'low',
         area: 'dependency',
         title: `${name} ${version} → ${dep.latest}`,
-        detail: 'Major version behind.',
-        fix: { kind: 'bump-dep', name, from: version, to: dep.latest, native },
+        detail: expoManaged ? 'Major version behind; the Expo SDK upgrade moves it.' : 'Major version behind.',
+        fix: { kind: 'bump-dep', name, from: version, to: dep.latest, native, expoManaged },
       });
     }
   }

package/src/expo-pins.js

@@ -0,0 +1,34 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+// Libraries whose version an Expo SDK decides (from Expo's bundledNativeModules.json). When the
+// app's own copy of that file is installed it is used instead; this list covers scans without
+// node_modules.
+const EXPO_PINNED = new Set([
+  'react-native-reanimated', 'react-native-worklets', 'react-native-gesture-handler', 'react-native-screens',
+  'react-native-safe-area-context', 'react-native-webview', 'react-native-svg', 'react-native-pager-view',
+  'react-native-maps', 'react-native-view-shot', 'react-native-get-random-values', 'react-native-keyboard-controller',
+  '@react-native-async-storage/async-storage', '@react-native-community/datetimepicker', '@react-native-community/slider',
+  '@react-native-community/netinfo', '@react-native-picker/picker', '@react-native-masked-view/masked-view',
+  'lottie-react-native', '@shopify/flash-list', '@shopify/react-native-skia', '@stripe/stripe-react-native',
+]);
+
+export function expoPinnedNames(root) {
+  try {
+    let dir = root;
+    while (true) {
+      const file = path.join(dir, 'node_modules', 'expo', 'bundledNativeModules.json');
+      if (fs.existsSync(file)) return new Set(Object.keys(JSON.parse(fs.readFileSync(file, 'utf8'))));
+      const parent = path.dirname(dir);
+      if (parent === dir) return EXPO_PINNED;
+      dir = parent;
+    }
+  } catch {
+    return EXPO_PINNED;
+  }
+}
+
+// Packages an Expo SDK upgrade moves on its own (`npx expo install --fix`): no separate work.
+export function movesWithExpoSdk(name, pinned) {
+  return /^(expo-|@expo\/)/.test(name) || ['expo', 'jest-expo', 'react-native', 'react', 'react-dom'].includes(name) || pinned.has(name);
+}

package/src/plan.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { UPGRADE_HELPER_URL, NEW_ARCH_ONLY_MINOR } from './rules.js';
 import { SITE_URL } from './config.js';
 import { COMPAT, bestRange } from './compat.js';
+import { expoPinnedNames, movesWithExpoSdk } from './expo-pins.js';
 
 // Turns a scan result into an ordered upgrade plan. The order matters more than the steps:
 // stop leaks first, then remove blockers, switch architecture on the current version,
@@ -145,40 +146,13 @@ function safetyNetPhase(tool) {
   };
 }
 
-// Libraries whose version an Expo SDK decides (from Expo's bundledNativeModules.json). When the
-// app's own copy of that file is installed it is used instead; this list covers scans without
-// node_modules.
-const EXPO_PINNED = new Set([
-  'react-native-reanimated', 'react-native-worklets', 'react-native-gesture-handler', 'react-native-screens',
-  'react-native-safe-area-context', 'react-native-webview', 'react-native-svg', 'react-native-pager-view',
-  'react-native-maps', 'react-native-view-shot', 'react-native-get-random-values', 'react-native-keyboard-controller',
-  '@react-native-async-storage/async-storage', '@react-native-community/datetimepicker', '@react-native-community/slider',
-  '@react-native-community/netinfo', '@react-native-picker/picker', '@react-native-masked-view/masked-view',
-  'lottie-react-native', '@shopify/flash-list', '@shopify/react-native-skia', '@stripe/stripe-react-native',
-]);
-
-function expoPinnedNames(root) {
-  try {
-    let dir = root;
-    while (true) {
-      const file = path.join(dir, 'node_modules', 'expo', 'bundledNativeModules.json');
-      if (fs.existsSync(file)) return new Set(Object.keys(JSON.parse(fs.readFileSync(file, 'utf8'))));
-      const parent = path.dirname(dir);
-      if (parent === dir) return EXPO_PINNED;
-      dir = parent;
-    }
-  } catch {
-    return EXPO_PINNED;
-  }
-}
-
 export function buildPlan(result) {
   const isExpo = !!result.project.expo;
   const basePm = commands[packageManager(result.project.root)];
   // In Expo projects `npx expo install` picks the version that matches the SDK.
   const pm = isExpo ? { ...basePm, add: 'npx expo install' } : basePm;
   const pinned = isExpo ? expoPinnedNames(result.project.root) : new Set();
-  const movesWithExpo = (name) => isExpo && (/^(expo-|@expo\/)/.test(name) || ['expo', 'jest-expo', 'react-native', 'react', 'react-dom'].includes(name) || pinned.has(name));
+  const movesWithExpo = (name) => isExpo && movesWithExpoSdk(name, pinned);
   const installed = new Set(result.deps.map((d) => d.name));
   const byKind = (kind) => result.findings.filter((f) => f.fix && f.fix.kind === kind).map((f) => f.fix);
   const phases = [];
@@ -289,7 +263,7 @@ export function buildPlan(result) {
       sec.push({ sev, step: f.fix.step });
     } else if (f.fix.kind === 'vuln-dep' && (f.fix.severity === 'critical' || f.fix.severity === 'high')) {
       const v = f.fix;
-      sec.push({ sev, step: `Update \`${v.name}\` ${v.from}${v.to ? ` to ${v.to} or later` : ''}: it has ${v.severity} known vulnerabilities. ${movesWithExpo(v.name) ? 'Expo pins it: the SDK upgrade below moves it.' : 'Check its changelog for breaking changes.'}` });
+      sec.push({ sev, step: `Update \`${v.name}\` ${v.from}${v.to ? ` to ${v.to}${v.to.startsWith('a release') ? '' : ' or later'}` : ''}: it has ${v.severity} known vulnerabilities. ${movesWithExpo(v.name) ? 'Expo pins it: the SDK upgrade below moves it.' : 'Check its changelog for breaking changes.'}` });
     }
   }
   const securitySteps = sec.sort((a, b) => a.sev - b.sev).map((x) => x.step);

package/src/report-html.js

@@ -26,8 +26,8 @@ export function htmlReport(result, { brand = null, plan = null } = {}) {
   ).join('\n');
   const bumps = result.findings.filter(isBump);
   const bumpTable = bumps.length
-    ? `<details class="bumps"><summary>${bumps.length} package${bumps.length === 1 ? ' is' : 's are'} a major version behind <span class="muted">(low)</span></summary><table><thead><tr><th>Package</th><th>Installed</th><th>Latest</th><th></th></tr></thead><tbody>${bumps
-        .map((f) => `<tr><td>${esc(f.fix.name)}</td><td>${esc(f.fix.from || '')}</td><td>${esc(f.fix.to || '')}</td><td class="muted">${f.fix.native ? 'native' : ''}</td></tr>`)
+    ? `<details class="bumps"><summary>${bumps.length} package${bumps.length === 1 ? ' is' : 's are'} a major version behind${bumps.some((f) => f.fix.expoManaged) ? ` <span class="muted">(${bumps.filter((f) => f.fix.expoManaged).length} move with the Expo SDK upgrade)</span>` : ' <span class="muted">(low)</span>'}</summary><table><thead><tr><th>Package</th><th>Installed</th><th>Latest</th><th></th></tr></thead><tbody>${bumps
+        .map((f) => `<tr><td>${esc(f.fix.name)}</td><td>${esc(f.fix.from || '')}</td><td>${esc(f.fix.to || '')}</td><td class="muted">${[f.fix.native && 'native', f.fix.expoManaged && 'moves with Expo SDK'].filter(Boolean).join(', ')}</td></tr>`)
         .join('')}</tbody></table></details>`
     : '';
 

package/src/report-text.js

@@ -50,10 +50,17 @@ export function textReport(result, { color = true, verbose = false } = {}) {
       out.push('');
       continue;
     }
-    for (const f of group) {
+    // Packages the Expo SDK upgrade moves: one line, they are not separate work.
+    const expoMoves = group.filter((f) => f.fix && f.fix.expoManaged);
+    for (const f of group.filter((x) => !(x.fix && x.fix.expoManaged))) {
       out.push(`${label[sev]} ${c.bold(f.title)}`);
       out.push(c.gray(indent + f.detail));
     }
+    if (expoMoves.length) {
+      const names = expoMoves.map((f) => f.fix.name);
+      out.push(`${label[sev]} ${c.bold(`${expoMoves.length} package${expoMoves.length === 1 ? '' : 's'} move with the Expo SDK upgrade`)}`);
+      out.push(c.gray(`${indent}${(verbose ? names : names.slice(0, 6)).join(', ')}${!verbose && names.length > 6 ? `, … (${names.length - 6} more with --verbose)` : ''}. \`npx expo install --fix\` sets the versions the new SDK expects.`));
+    }
     out.push('');
   }
 

package/src/security.js

@@ -33,7 +33,7 @@ const read = (file) => {
   }
 };
 
-const SERVER_ONLY = /node\.?js|server[- ]side|\bhttp adapter\b|\bssr\b/i;
+const SERVER_ONLY = /node\.?js|server[- ]side|\bhttp adapter\b|\bhttp\/2\b|\bssr\b|\bssrf\b|no_proxy|proxy-authorization|cloud metadata/i;
 const SEVERITY = { critical: 'critical', high: 'high', moderate: 'medium', low: 'low', info: 'low' };
 const RANK = ['low', 'medium', 'high', 'critical'];
 
@@ -65,8 +65,8 @@ export async function vulnerableDependencies(registry, versions) {
       id: `vuln:${name}`,
       severity,
       area: 'security',
-      title: `${name} ${version}: ${relevant.length} known vulnerabilit${relevant.length === 1 ? 'y' : 'ies'}`,
-      detail: `${top.join('; ')}${relevant.length > 3 ? `; and ${relevant.length - 3} more` : ''}. ${fixedIn ? `Fixed in ${fixedIn} or later.` : 'Check the advisories for a fixed version.'}${serverOnly ? ` ${serverOnly} of them concern Node.js/server use only and are counted as low.` : ''} Source: GitHub Advisory Database (via npm).`,
+      title: `${name} ${version}: ${relevant.length} known vulnerabilit${relevant.length === 1 ? 'y' : 'ies'}${fixedIn ? ` (fixed in ${fixedIn})` : ''}`,
+      detail: `${top.join('; ')}${relevant.length > 3 ? `; and ${relevant.length - 3} more` : ''}. ${fixedIn ? `Fixed in ${fixedIn}${fixedIn.startsWith('a release') ? '' : ' or later'}.` : 'Check the advisories for a fixed version.'}${serverOnly ? ` ${serverOnly} of them concern Node.js/server use only and are counted as low.` : ''} Source: GitHub Advisory Database (via npm).`,
       fix: { kind: 'vuln-dep', name, from: version, to: fixedIn, severity },
     });
   }
@@ -87,15 +87,17 @@ function applies(version, range) {
   });
 }
 
+// The lowest version outside every advisory's range. "<1.2.3" is fixed in 1.2.3; "<=1.2.2" only
+// says "after 1.2.2", which counts when it is the highest bound.
 function minimumFixed(advisories) {
   let fixed = null;
   for (const a of advisories) {
-    const bounds = [...String(a.vulnerable_versions || '').matchAll(/<\s*(\d+\.\d+\.\d+)/g)].map((m) => m[1]);
+    const bounds = [...String(a.vulnerable_versions || '').matchAll(/<(=?)\s*(\d+\.\d+\.\d+)/g)].map((m) => ({ v: m[2], after: m[1] === '=' }));
     if (!bounds.length) return null; // an advisory without a fixed version
-    const hi = bounds.sort(compareVersions).at(-1);
-    if (!fixed || compareVersions(hi, fixed) > 0) fixed = hi;
+    const hi = bounds.sort((x, y) => compareVersions(x.v, y.v) || (x.after ? 1 : -1)).at(-1);
+    if (!fixed || compareVersions(hi.v, fixed.v) > 0 || (compareVersions(hi.v, fixed.v) === 0 && hi.after)) fixed = hi;
   }
-  return fixed;
+  return fixed && (fixed.after ? `a release after ${fixed.v}` : fixed.v);
 }
 
 // A password (or the variables built from it) passed to a log, crash report, analytics event,