nativekeel 0.1.16 → 0.1.18

package/README.md

@@ -6,7 +6,7 @@ Health check for React Native and Expo apps. One command, no install, no account
 npx nativekeel
 ```
 
-**What's new in 0.1.16:** deep-link checks: unverified Android App Links, and the template `myapp://` scheme that other apps can claim (MASVS-PLATFORM). **0.1.15:** run it at a monorepo root and it lists the app folders to scan. **0.1.14:** secrets in Expo config (`extra`, `EXPO_PUBLIC_`, `eas.json`) and imports of APIs removed from React Native core. Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 450+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
+**What's new in 0.1.18:** the upgrade plan only suggests library versions your current React Native supports, moves React Navigation and RN Firebase packages together, and says plainly when a vulnerable package has no fixed release. **0.1.17:** every vulnerable package shows the version that fixes it; Expo apps get one line for the packages the SDK upgrade moves. Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 450+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
 
 ```
 Summary  4 critical · 5 high · 4 medium · 6 low

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nativekeel",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "Health check for React Native and Expo apps: upgrade blockers, store deadlines, crash risks, vulnerable dependencies and leaked secrets, with a step-by-step upgrade plan.",
   "type": "module",
   "bin": {

package/src/analyze.js

@@ -8,6 +8,7 @@ import { stabilityChecks } from './stability.js';
 import { performanceChecks } from './performance.js';
 import { vulnerableDependencies, passwordLeaks, webViewRisks, androidBackup, exportedComponents, plainHttpCalls, cloudRules, insecureTls, weakCrypto, tokenStorage, reverseEngineering, expoConfigSecrets, deepLinks, masvsOf, MASVS_GROUPS } from './security.js';
 import { lockedVersions } from './lockfile.js';
+import { expoPinnedNames, movesWithExpoSdk } from './expo-pins.js';
 import { findUnused, filesImportingWith } from './usage.js';
 import { matchKnownIssues, compareVersions } from './known-issues.js';
 import { COMPAT, bestRange, checkCompat } from './compat.js';
@@ -54,6 +55,11 @@ function isNativeModule(root, name, dir) {
       return false;
     }
   }
+  // Known without looking: React Navigation is JavaScript only (the directory reports its
+  // monorepo as native), and the renamed community packages all contain native code (some
+  // were removed from the directory).
+  if (/^@react-navigation\//.test(name)) return false;
+  if (RENAMED[name]) return true;
   // Without node_modules, ask React Native Directory. Its ios/android flags mean "works on",
   // not "has native code" (pure JS packages set them too), so prefer its hasNativeCode.
   if (dir && dir.github && typeof dir.github.hasNativeCode === 'boolean') return dir.github.hasNativeCode;
@@ -232,6 +238,8 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
   const codegen = forcedOffline ? {} : await registry.codegenSupport(archSuspects.map((n) => ({ name: n, version: versionOf(n) })));
 
   const deps = [];
+  let pinnedCache = null;
+  const expoPinned = () => (pinnedCache ||= expoPinnedNames(project.root));
   for (const name of names) {
     const dir = directory[name];
     const version = versionOf(name);
@@ -296,13 +304,15 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
       });
     }
     if (!noNewArch && !dep.unmaintained && !stale && version && dep.latest && lineOf(version) !== lineOf(dep.latest)) {
+      // In Expo apps the SDK decides these versions: the SDK upgrade moves them, no separate work.
+      const expoManaged = !!project.expoVersion && movesWithExpoSdk(name, expoPinned());
       add({
         id: `dep-major:${name}`,
-        severity: 'low',
+        severity: expoManaged ? 'info' : 'low',
         area: 'dependency',
         title: `${name} ${version} → ${dep.latest}`,
-        detail: 'Major version behind.',
-        fix: { kind: 'bump-dep', name, from: version, to: dep.latest, native },
+        detail: expoManaged ? 'Major version behind; the Expo SDK upgrade moves it.' : 'Major version behind.',
+        fix: { kind: 'bump-dep', name, from: version, to: dep.latest, native, expoManaged },
       });
     }
   }
@@ -421,7 +431,7 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
       const v = installedVersion(project.root, name) || locked[name];
       if (v && /^\d+\.\d+\.\d+/.test(v)) exact[name] = v;
     }
-    const vulns = await vulnerableDependencies(registry, exact);
+    const vulns = await vulnerableDependencies(registry, exact, latest);
     if (vulns === null) net.failed++;
     for (const f of vulns || []) add(f);
   }

package/src/compat.js

@@ -108,6 +108,8 @@ const rnLabel = (row) => (row.rnMax ? `0.${row.rnMin}–0.${row.rnMax}` : `0.${r
 function versionLabel(row) {
   const from = row.from.replace(/\.0$/, '');
   if (!row.to) return `${from}+`;
+  // "2.99.99" means the rest of that major line.
+  if (/^\d+\.99\.99$/.test(row.to)) return `${from}+ (${row.to.split('.')[0]}.x line)`;
   const to = row.to.replace(/\.99$/, '');
   return from === to ? `${from}.x` : `${from}–${to}.x`;
 }

package/src/expo-pins.js

@@ -0,0 +1,34 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+// Libraries whose version an Expo SDK decides (from Expo's bundledNativeModules.json). When the
+// app's own copy of that file is installed it is used instead; this list covers scans without
+// node_modules.
+const EXPO_PINNED = new Set([
+  'react-native-reanimated', 'react-native-worklets', 'react-native-gesture-handler', 'react-native-screens',
+  'react-native-safe-area-context', 'react-native-webview', 'react-native-svg', 'react-native-pager-view',
+  'react-native-maps', 'react-native-view-shot', 'react-native-get-random-values', 'react-native-keyboard-controller',
+  '@react-native-async-storage/async-storage', '@react-native-community/datetimepicker', '@react-native-community/slider',
+  '@react-native-community/netinfo', '@react-native-picker/picker', '@react-native-masked-view/masked-view',
+  'lottie-react-native', '@shopify/flash-list', '@shopify/react-native-skia', '@stripe/stripe-react-native',
+]);
+
+export function expoPinnedNames(root) {
+  try {
+    let dir = root;
+    while (true) {
+      const file = path.join(dir, 'node_modules', 'expo', 'bundledNativeModules.json');
+      if (fs.existsSync(file)) return new Set(Object.keys(JSON.parse(fs.readFileSync(file, 'utf8'))));
+      const parent = path.dirname(dir);
+      if (parent === dir) return EXPO_PINNED;
+      dir = parent;
+    }
+  } catch {
+    return EXPO_PINNED;
+  }
+}
+
+// Packages an Expo SDK upgrade moves on its own (`npx expo install --fix`): no separate work.
+export function movesWithExpoSdk(name, pinned) {
+  return /^(expo-|@expo\/)/.test(name) || ['expo', 'jest-expo', 'react-native', 'react', 'react-dom'].includes(name) || pinned.has(name);
+}

package/src/plan.js

@@ -3,6 +3,8 @@ import path from 'node:path';
 import { UPGRADE_HELPER_URL, NEW_ARCH_ONLY_MINOR } from './rules.js';
 import { SITE_URL } from './config.js';
 import { COMPAT, bestRange } from './compat.js';
+import { compareVersions } from './known-issues.js';
+import { expoPinnedNames, movesWithExpoSdk } from './expo-pins.js';
 
 // Turns a scan result into an ordered upgrade plan. The order matters more than the steps:
 // stop leaks first, then remove blockers, switch architecture on the current version,
@@ -145,31 +147,27 @@ function safetyNetPhase(tool) {
   };
 }
 
-// Libraries whose version an Expo SDK decides (from Expo's bundledNativeModules.json). When the
-// app's own copy of that file is installed it is used instead; this list covers scans without
-// node_modules.
-const EXPO_PINNED = new Set([
-  'react-native-reanimated', 'react-native-worklets', 'react-native-gesture-handler', 'react-native-screens',
-  'react-native-safe-area-context', 'react-native-webview', 'react-native-svg', 'react-native-pager-view',
-  'react-native-maps', 'react-native-view-shot', 'react-native-get-random-values', 'react-native-keyboard-controller',
-  '@react-native-async-storage/async-storage', '@react-native-community/datetimepicker', '@react-native-community/slider',
-  '@react-native-community/netinfo', '@react-native-picker/picker', '@react-native-masked-view/masked-view',
-  'lottie-react-native', '@shopify/flash-list', '@shopify/react-native-skia', '@stripe/stripe-react-native',
-]);
-
-function expoPinnedNames(root) {
-  try {
-    let dir = root;
-    while (true) {
-      const file = path.join(dir, 'node_modules', 'expo', 'bundledNativeModules.json');
-      if (fs.existsSync(file)) return new Set(Object.keys(JSON.parse(fs.readFileSync(file, 'utf8'))));
-      const parent = path.dirname(dir);
-      if (parent === dir) return EXPO_PINNED;
-      dir = parent;
+// Package families that must share a major version: updating one alone crashes at runtime.
+const FAMILIES = [
+  { re: /^@react-navigation\//, label: 'React Navigation' },
+  { re: /^@react-native-firebase\//, label: 'React Native Firebase' },
+];
+function bumpSteps(list, extra = () => '') {
+  const steps = [];
+  const done = new Set();
+  for (const d of list) {
+    if (done.has(d.name)) continue;
+    const fam = FAMILIES.find((f) => f.re.test(d.name));
+    const members = fam ? list.filter((x) => fam.re.test(x.name)) : [];
+    if (members.length > 1) {
+      for (const m of members) done.add(m.name);
+      steps.push(`${fam.label}, all together in one change (mixed majors crash at runtime): ${members.map((m) => `\`${m.name}\` ${m.from} → ${m.to}${extra(m)}`).join(', ')}.`);
+    } else {
+      done.add(d.name);
+      steps.push(`\`${d.name}\` ${d.from} → ${d.to}${extra(d)}`);
     }
-  } catch {
-    return EXPO_PINNED;
   }
+  return steps;
 }
 
 export function buildPlan(result) {
@@ -178,7 +176,7 @@ export function buildPlan(result) {
   // In Expo projects `npx expo install` picks the version that matches the SDK.
   const pm = isExpo ? { ...basePm, add: 'npx expo install' } : basePm;
   const pinned = isExpo ? expoPinnedNames(result.project.root) : new Set();
-  const movesWithExpo = (name) => isExpo && (/^(expo-|@expo\/)/.test(name) || ['expo', 'jest-expo', 'react-native', 'react', 'react-dom'].includes(name) || pinned.has(name));
+  const movesWithExpo = (name) => isExpo && movesWithExpoSdk(name, pinned);
   const installed = new Set(result.deps.map((d) => d.name));
   const byKind = (kind) => result.findings.filter((f) => f.fix && f.fix.kind === kind).map((f) => f.fix);
   const phases = [];
@@ -286,10 +284,13 @@ export function buildPlan(result) {
     } else if (f.fix.kind === 'ats') {
       sec.push({ sev, step: `In \`${f.fix.file}\`, set \`NSAllowsArbitraryLoads\` to false and list only the hosts that need HTTP under \`NSExceptionDomains\`.` });
     } else if (f.fix.kind === 'security') {
-      sec.push({ sev, step: f.fix.step });
+      // Hermes gets its own, more detailed step under legacy tooling.
+      const step = byKind('enable-hermes').length ? f.fix.step.replace('Turn on Hermes. ', '') : f.fix.step;
+      sec.push({ sev, step });
     } else if (f.fix.kind === 'vuln-dep' && (f.fix.severity === 'critical' || f.fix.severity === 'high')) {
       const v = f.fix;
-      sec.push({ sev, step: `Update \`${v.name}\` ${v.from}${v.to ? ` to ${v.to} or later` : ''}: it has ${v.severity} known vulnerabilities. ${movesWithExpo(v.name) ? 'Expo pins it: the SDK upgrade below moves it.' : 'Check its changelog for breaking changes.'}` });
+      if (v.noFix) sec.push({ sev, step: `\`${v.name}\` ${v.from} has ${v.severity} known vulnerabilities and no fixed release (the latest is ${v.latest}): replace it, or make sure it never handles untrusted input.` });
+      else sec.push({ sev, step: `Update \`${v.name}\` ${v.from}${v.to ? ` to ${v.to}${v.to.startsWith('a release') ? '' : ' or later'}` : ''}: it has ${v.severity} known vulnerabilities. ${movesWithExpo(v.name) ? 'Expo pins it: the SDK upgrade below moves it.' : 'Check its changelog for breaking changes.'}` });
     }
   }
   const securitySteps = sec.sort((a, b) => a.sev - b.sev).map((x) => x.step);
@@ -364,12 +365,26 @@ export function buildPlan(result) {
   }
 
   const expoMoves = byKind('bump-dep').filter((d) => movesWithExpo(d.name));
-  const nativeBumps = byKind('bump-dep').filter((d) => d.native && !movesWithExpo(d.name));
+  // Libraries with a compatibility table: only as far as the current React Native supports.
+  // The React Native steps move them further.
+  const curMinor = result.project.reactNative ? Number(result.project.reactNative.split('.')[1]) : null;
+  const archNow = !byKind('enable-new-arch').length;
+  const nativeBumps = byKind('bump-dep')
+    .filter((d) => d.native && !movesWithExpo(d.name))
+    .map((d) => {
+      if (!COMPAT[d.name] || curMinor === null) return d;
+      const best = bestRange(d.name, curMinor, archNow);
+      if (!best) return d;
+      if (compareVersions(d.from, best.from) >= 0 && (!best.to || compareVersions(d.from, best.to) <= 0)) return null;
+      if (compareVersions(d.from, best.from) > 0) return null;
+      return { ...d, to: best.range, capped: `0.${curMinor}` };
+    })
+    .filter(Boolean);
   if (nativeBumps.length) {
     phases.push({
       title: 'Update native modules on the current React Native version',
       why: 'Newer releases of native modules usually add New Architecture support. Pick the newest release that still supports your current React Native version; check each changelog for its minimum.',
-      steps: nativeBumps.map((d) => `\`${d.name}\` ${d.from} → ${d.to}`),
+      steps: bumpSteps(nativeBumps, (d) => (d.capped ? ` (the newest for React Native ${d.capped}; later versions come with the React Native steps below)` : '')),
     });
   }
 
@@ -541,7 +556,7 @@ export function buildPlan(result) {
     phases.push({
       title: 'Update JavaScript-only packages',
       why: 'These do not block the upgrade. Do them last, one major at a time, following each migration guide.',
-      steps: jsBumps.map((d) => `\`${d.name}\` ${d.from} → ${d.to}`),
+      steps: bumpSteps(jsBumps),
     });
   }
 

package/src/report-html.js

@@ -5,7 +5,7 @@ import { MASVS_GROUPS } from './security.js';
 
 const esc = (s) => String(s ?? '').replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[ch]);
 // Turns `code` spans from finding text into <code>.
-const rich = (s) => esc(s).replace(/`([^`]+)`/g, '<code>$1</code>');
+const rich = (s) => esc(s).replace(/`([^`]+)`/g, '<code>$1</code>').replace(/\*\*([^*]+)\*\*/g, '<strong>$1</strong>');
 
 // A single self-contained file that can be emailed or attached to a ticket.
 // `brand` replaces NativeKeel branding with an agency's name.
@@ -26,8 +26,8 @@ export function htmlReport(result, { brand = null, plan = null } = {}) {
   ).join('\n');
   const bumps = result.findings.filter(isBump);
   const bumpTable = bumps.length
-    ? `<details class="bumps"><summary>${bumps.length} package${bumps.length === 1 ? ' is' : 's are'} a major version behind <span class="muted">(low)</span></summary><table><thead><tr><th>Package</th><th>Installed</th><th>Latest</th><th></th></tr></thead><tbody>${bumps
-        .map((f) => `<tr><td>${esc(f.fix.name)}</td><td>${esc(f.fix.from || '')}</td><td>${esc(f.fix.to || '')}</td><td class="muted">${f.fix.native ? 'native' : ''}</td></tr>`)
+    ? `<details class="bumps"><summary>${bumps.length} package${bumps.length === 1 ? ' is' : 's are'} a major version behind${bumps.some((f) => f.fix.expoManaged) ? ` <span class="muted">(${bumps.filter((f) => f.fix.expoManaged).length} move with the Expo SDK upgrade)</span>` : ' <span class="muted">(low)</span>'}</summary><table><thead><tr><th>Package</th><th>Installed</th><th>Latest</th><th></th></tr></thead><tbody>${bumps
+        .map((f) => `<tr><td>${esc(f.fix.name)}</td><td>${esc(f.fix.from || '')}</td><td>${esc(f.fix.to || '')}</td><td class="muted">${[f.fix.native && 'native', f.fix.expoManaged && 'moves with Expo SDK'].filter(Boolean).join(', ')}</td></tr>`)
         .join('')}</tbody></table></details>`
     : '';
 

package/src/report-text.js

@@ -50,10 +50,17 @@ export function textReport(result, { color = true, verbose = false } = {}) {
       out.push('');
       continue;
     }
-    for (const f of group) {
+    // Packages the Expo SDK upgrade moves: one line, they are not separate work.
+    const expoMoves = group.filter((f) => f.fix && f.fix.expoManaged);
+    for (const f of group.filter((x) => !(x.fix && x.fix.expoManaged))) {
       out.push(`${label[sev]} ${c.bold(f.title)}`);
       out.push(c.gray(indent + f.detail));
     }
+    if (expoMoves.length) {
+      const names = expoMoves.map((f) => f.fix.name);
+      out.push(`${label[sev]} ${c.bold(`${expoMoves.length} package${expoMoves.length === 1 ? '' : 's'} move with the Expo SDK upgrade`)}`);
+      out.push(c.gray(`${indent}${(verbose ? names : names.slice(0, 6)).join(', ')}${!verbose && names.length > 6 ? `, … (${names.length - 6} more with --verbose)` : ''}. \`npx expo install --fix\` sets the versions the new SDK expects.`));
+    }
     out.push('');
   }
 

package/src/security.js

@@ -33,12 +33,12 @@ const read = (file) => {
   }
 };
 
-const SERVER_ONLY = /node\.?js|server[- ]side|\bhttp adapter\b|\bssr\b/i;
+const SERVER_ONLY = /node\.?js|server[- ]side|\bhttp adapter\b|\bhttp\/2\b|\bssr\b|\bssrf\b|no_proxy|proxy-authorization|cloud metadata/i;
 const SEVERITY = { critical: 'critical', high: 'high', moderate: 'medium', low: 'low', info: 'low' };
 const RANK = ['low', 'medium', 'high', 'critical'];
 
 // Advisories for the exact versions of runtime dependencies (devDependencies never ship).
-export async function vulnerableDependencies(registry, versions) {
+export async function vulnerableDependencies(registry, versions, latestOf = {}) {
   const names = Object.keys(versions);
   if (!names.length) return [];
   const advisories = await registry.advisories(versions);
@@ -55,7 +55,18 @@ export async function vulnerableDependencies(registry, versions) {
     const sevOf = (a) => (SERVER_ONLY.test(a.title || '') ? 'low' : SEVERITY[a.severity] || 'low');
     const severity = relevant.map(sevOf).sort((a, b) => RANK.indexOf(b) - RANK.indexOf(a))[0];
     const serverOnly = relevant.filter((a) => SERVER_ONLY.test(a.title || '')).length;
-    const fixedIn = minimumFixed(relevant);
+    let fixedIn = minimumFixed(relevant);
+    // Compare with what is published: "<=2.0.2" when 2.0.2 is the latest release means no fix exists.
+    const newest = latestOf[name];
+    let noFix = false;
+    if (fixedIn && newest) {
+      const after = fixedIn.startsWith('a release after ') ? fixedIn.slice('a release after '.length) : null;
+      if (after) {
+        if (compareVersions(newest, after) > 0) fixedIn = newest;
+        else noFix = true;
+      } else if (compareVersions(newest, fixedIn) < 0) noFix = true;
+      if (noFix) fixedIn = null;
+    }
     const top = relevant
       .slice()
       .sort((a, b) => RANK.indexOf(sevOf(b)) - RANK.indexOf(sevOf(a)))
@@ -65,9 +76,9 @@ export async function vulnerableDependencies(registry, versions) {
       id: `vuln:${name}`,
       severity,
       area: 'security',
-      title: `${name} ${version}: ${relevant.length} known vulnerabilit${relevant.length === 1 ? 'y' : 'ies'}`,
-      detail: `${top.join('; ')}${relevant.length > 3 ? `; and ${relevant.length - 3} more` : ''}. ${fixedIn ? `Fixed in ${fixedIn} or later.` : 'Check the advisories for a fixed version.'}${serverOnly ? ` ${serverOnly} of them concern Node.js/server use only and are counted as low.` : ''} Source: GitHub Advisory Database (via npm).`,
-      fix: { kind: 'vuln-dep', name, from: version, to: fixedIn, severity },
+      title: `${name} ${version}: ${relevant.length} known vulnerabilit${relevant.length === 1 ? 'y' : 'ies'}${fixedIn ? ` (fixed in ${fixedIn})` : noFix ? ' (no fixed release)' : ''}`,
+      detail: `${top.join('; ')}${relevant.length > 3 ? `; and ${relevant.length - 3} more` : ''}. ${fixedIn ? `Fixed in ${fixedIn}${fixedIn.startsWith('a release') ? '' : ' or later'}.` : noFix ? `No fixed release exists yet (the latest is ${newest}): replace it, or make sure it never handles untrusted input.` : 'Check the advisories for a fixed version.'}${serverOnly ? ` ${serverOnly} of them concern Node.js/server use only and are counted as low.` : ''} Source: GitHub Advisory Database (via npm).`,
+      fix: { kind: 'vuln-dep', name, from: version, to: fixedIn, noFix, latest: newest || null, severity },
     });
   }
   return findings;
@@ -87,15 +98,17 @@ function applies(version, range) {
   });
 }
 
+// The lowest version outside every advisory's range. "<1.2.3" is fixed in 1.2.3; "<=1.2.2" only
+// says "after 1.2.2", which counts when it is the highest bound.
 function minimumFixed(advisories) {
   let fixed = null;
   for (const a of advisories) {
-    const bounds = [...String(a.vulnerable_versions || '').matchAll(/<\s*(\d+\.\d+\.\d+)/g)].map((m) => m[1]);
+    const bounds = [...String(a.vulnerable_versions || '').matchAll(/<(=?)\s*(\d+\.\d+\.\d+)/g)].map((m) => ({ v: m[2], after: m[1] === '=' }));
     if (!bounds.length) return null; // an advisory without a fixed version
-    const hi = bounds.sort(compareVersions).at(-1);
-    if (!fixed || compareVersions(hi, fixed) > 0) fixed = hi;
+    const hi = bounds.sort((x, y) => compareVersions(x.v, y.v) || (x.after ? 1 : -1)).at(-1);
+    if (!fixed || compareVersions(hi.v, fixed.v) > 0 || (compareVersions(hi.v, fixed.v) === 0 && hi.after)) fixed = hi;
   }
-  return fixed;
+  return fixed && (fixed.after ? `a release after ${fixed.v}` : fixed.v);
 }
 
 // A password (or the variables built from it) passed to a log, crash report, analytics event,