nativekeel 0.1.17 → 0.1.18

package/README.md

@@ -6,7 +6,7 @@ Health check for React Native and Expo apps. One command, no install, no account
 npx nativekeel
 ```
 
-**What's new in 0.1.17:** every vulnerable package shows the version that fixes it, and Expo apps get one line for the packages the SDK upgrade moves instead of a long list. **0.1.16:** deep-link checks: unverified Android App Links, and the template `myapp://` scheme that other apps can claim (MASVS-PLATFORM). Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 450+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
+**What's new in 0.1.18:** the upgrade plan only suggests library versions your current React Native supports, moves React Navigation and RN Firebase packages together, and says plainly when a vulnerable package has no fixed release. **0.1.17:** every vulnerable package shows the version that fixes it; Expo apps get one line for the packages the SDK upgrade moves. Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 450+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
 
 ```
 Summary  4 critical · 5 high · 4 medium · 6 low

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nativekeel",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "Health check for React Native and Expo apps: upgrade blockers, store deadlines, crash risks, vulnerable dependencies and leaked secrets, with a step-by-step upgrade plan.",
   "type": "module",
   "bin": {

package/src/analyze.js

@@ -55,6 +55,11 @@ function isNativeModule(root, name, dir) {
       return false;
     }
   }
+  // Known without looking: React Navigation is JavaScript only (the directory reports its
+  // monorepo as native), and the renamed community packages all contain native code (some
+  // were removed from the directory).
+  if (/^@react-navigation\//.test(name)) return false;
+  if (RENAMED[name]) return true;
   // Without node_modules, ask React Native Directory. Its ios/android flags mean "works on",
   // not "has native code" (pure JS packages set them too), so prefer its hasNativeCode.
   if (dir && dir.github && typeof dir.github.hasNativeCode === 'boolean') return dir.github.hasNativeCode;
@@ -426,7 +431,7 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
       const v = installedVersion(project.root, name) || locked[name];
       if (v && /^\d+\.\d+\.\d+/.test(v)) exact[name] = v;
     }
-    const vulns = await vulnerableDependencies(registry, exact);
+    const vulns = await vulnerableDependencies(registry, exact, latest);
     if (vulns === null) net.failed++;
     for (const f of vulns || []) add(f);
   }

package/src/compat.js

@@ -108,6 +108,8 @@ const rnLabel = (row) => (row.rnMax ? `0.${row.rnMin}–0.${row.rnMax}` : `0.${r
 function versionLabel(row) {
   const from = row.from.replace(/\.0$/, '');
   if (!row.to) return `${from}+`;
+  // "2.99.99" means the rest of that major line.
+  if (/^\d+\.99\.99$/.test(row.to)) return `${from}+ (${row.to.split('.')[0]}.x line)`;
   const to = row.to.replace(/\.99$/, '');
   return from === to ? `${from}.x` : `${from}–${to}.x`;
 }

package/src/plan.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { UPGRADE_HELPER_URL, NEW_ARCH_ONLY_MINOR } from './rules.js';
 import { SITE_URL } from './config.js';
 import { COMPAT, bestRange } from './compat.js';
+import { compareVersions } from './known-issues.js';
 import { expoPinnedNames, movesWithExpoSdk } from './expo-pins.js';
 
 // Turns a scan result into an ordered upgrade plan. The order matters more than the steps:
@@ -146,6 +147,29 @@ function safetyNetPhase(tool) {
   };
 }
 
+// Package families that must share a major version: updating one alone crashes at runtime.
+const FAMILIES = [
+  { re: /^@react-navigation\//, label: 'React Navigation' },
+  { re: /^@react-native-firebase\//, label: 'React Native Firebase' },
+];
+function bumpSteps(list, extra = () => '') {
+  const steps = [];
+  const done = new Set();
+  for (const d of list) {
+    if (done.has(d.name)) continue;
+    const fam = FAMILIES.find((f) => f.re.test(d.name));
+    const members = fam ? list.filter((x) => fam.re.test(x.name)) : [];
+    if (members.length > 1) {
+      for (const m of members) done.add(m.name);
+      steps.push(`${fam.label}, all together in one change (mixed majors crash at runtime): ${members.map((m) => `\`${m.name}\` ${m.from} → ${m.to}${extra(m)}`).join(', ')}.`);
+    } else {
+      done.add(d.name);
+      steps.push(`\`${d.name}\` ${d.from} → ${d.to}${extra(d)}`);
+    }
+  }
+  return steps;
+}
+
 export function buildPlan(result) {
   const isExpo = !!result.project.expo;
   const basePm = commands[packageManager(result.project.root)];
@@ -260,10 +284,13 @@ export function buildPlan(result) {
     } else if (f.fix.kind === 'ats') {
       sec.push({ sev, step: `In \`${f.fix.file}\`, set \`NSAllowsArbitraryLoads\` to false and list only the hosts that need HTTP under \`NSExceptionDomains\`.` });
     } else if (f.fix.kind === 'security') {
-      sec.push({ sev, step: f.fix.step });
+      // Hermes gets its own, more detailed step under legacy tooling.
+      const step = byKind('enable-hermes').length ? f.fix.step.replace('Turn on Hermes. ', '') : f.fix.step;
+      sec.push({ sev, step });
     } else if (f.fix.kind === 'vuln-dep' && (f.fix.severity === 'critical' || f.fix.severity === 'high')) {
       const v = f.fix;
-      sec.push({ sev, step: `Update \`${v.name}\` ${v.from}${v.to ? ` to ${v.to}${v.to.startsWith('a release') ? '' : ' or later'}` : ''}: it has ${v.severity} known vulnerabilities. ${movesWithExpo(v.name) ? 'Expo pins it: the SDK upgrade below moves it.' : 'Check its changelog for breaking changes.'}` });
+      if (v.noFix) sec.push({ sev, step: `\`${v.name}\` ${v.from} has ${v.severity} known vulnerabilities and no fixed release (the latest is ${v.latest}): replace it, or make sure it never handles untrusted input.` });
+      else sec.push({ sev, step: `Update \`${v.name}\` ${v.from}${v.to ? ` to ${v.to}${v.to.startsWith('a release') ? '' : ' or later'}` : ''}: it has ${v.severity} known vulnerabilities. ${movesWithExpo(v.name) ? 'Expo pins it: the SDK upgrade below moves it.' : 'Check its changelog for breaking changes.'}` });
     }
   }
   const securitySteps = sec.sort((a, b) => a.sev - b.sev).map((x) => x.step);
@@ -338,12 +365,26 @@ export function buildPlan(result) {
   }
 
   const expoMoves = byKind('bump-dep').filter((d) => movesWithExpo(d.name));
-  const nativeBumps = byKind('bump-dep').filter((d) => d.native && !movesWithExpo(d.name));
+  // Libraries with a compatibility table: only as far as the current React Native supports.
+  // The React Native steps move them further.
+  const curMinor = result.project.reactNative ? Number(result.project.reactNative.split('.')[1]) : null;
+  const archNow = !byKind('enable-new-arch').length;
+  const nativeBumps = byKind('bump-dep')
+    .filter((d) => d.native && !movesWithExpo(d.name))
+    .map((d) => {
+      if (!COMPAT[d.name] || curMinor === null) return d;
+      const best = bestRange(d.name, curMinor, archNow);
+      if (!best) return d;
+      if (compareVersions(d.from, best.from) >= 0 && (!best.to || compareVersions(d.from, best.to) <= 0)) return null;
+      if (compareVersions(d.from, best.from) > 0) return null;
+      return { ...d, to: best.range, capped: `0.${curMinor}` };
+    })
+    .filter(Boolean);
   if (nativeBumps.length) {
     phases.push({
       title: 'Update native modules on the current React Native version',
       why: 'Newer releases of native modules usually add New Architecture support. Pick the newest release that still supports your current React Native version; check each changelog for its minimum.',
-      steps: nativeBumps.map((d) => `\`${d.name}\` ${d.from} → ${d.to}`),
+      steps: bumpSteps(nativeBumps, (d) => (d.capped ? ` (the newest for React Native ${d.capped}; later versions come with the React Native steps below)` : '')),
     });
   }
 
@@ -515,7 +556,7 @@ export function buildPlan(result) {
     phases.push({
       title: 'Update JavaScript-only packages',
       why: 'These do not block the upgrade. Do them last, one major at a time, following each migration guide.',
-      steps: jsBumps.map((d) => `\`${d.name}\` ${d.from} → ${d.to}`),
+      steps: bumpSteps(jsBumps),
     });
   }
 

package/src/report-html.js

@@ -5,7 +5,7 @@ import { MASVS_GROUPS } from './security.js';
 
 const esc = (s) => String(s ?? '').replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[ch]);
 // Turns `code` spans from finding text into <code>.
-const rich = (s) => esc(s).replace(/`([^`]+)`/g, '<code>$1</code>');
+const rich = (s) => esc(s).replace(/`([^`]+)`/g, '<code>$1</code>').replace(/\*\*([^*]+)\*\*/g, '<strong>$1</strong>');
 
 // A single self-contained file that can be emailed or attached to a ticket.
 // `brand` replaces NativeKeel branding with an agency's name.

package/src/security.js

@@ -38,7 +38,7 @@ const SEVERITY = { critical: 'critical', high: 'high', moderate: 'medium', low:
 const RANK = ['low', 'medium', 'high', 'critical'];
 
 // Advisories for the exact versions of runtime dependencies (devDependencies never ship).
-export async function vulnerableDependencies(registry, versions) {
+export async function vulnerableDependencies(registry, versions, latestOf = {}) {
   const names = Object.keys(versions);
   if (!names.length) return [];
   const advisories = await registry.advisories(versions);
@@ -55,7 +55,18 @@ export async function vulnerableDependencies(registry, versions) {
     const sevOf = (a) => (SERVER_ONLY.test(a.title || '') ? 'low' : SEVERITY[a.severity] || 'low');
     const severity = relevant.map(sevOf).sort((a, b) => RANK.indexOf(b) - RANK.indexOf(a))[0];
     const serverOnly = relevant.filter((a) => SERVER_ONLY.test(a.title || '')).length;
-    const fixedIn = minimumFixed(relevant);
+    let fixedIn = minimumFixed(relevant);
+    // Compare with what is published: "<=2.0.2" when 2.0.2 is the latest release means no fix exists.
+    const newest = latestOf[name];
+    let noFix = false;
+    if (fixedIn && newest) {
+      const after = fixedIn.startsWith('a release after ') ? fixedIn.slice('a release after '.length) : null;
+      if (after) {
+        if (compareVersions(newest, after) > 0) fixedIn = newest;
+        else noFix = true;
+      } else if (compareVersions(newest, fixedIn) < 0) noFix = true;
+      if (noFix) fixedIn = null;
+    }
     const top = relevant
       .slice()
       .sort((a, b) => RANK.indexOf(sevOf(b)) - RANK.indexOf(sevOf(a)))
@@ -65,9 +76,9 @@ export async function vulnerableDependencies(registry, versions) {
       id: `vuln:${name}`,
       severity,
       area: 'security',
-      title: `${name} ${version}: ${relevant.length} known vulnerabilit${relevant.length === 1 ? 'y' : 'ies'}${fixedIn ? ` (fixed in ${fixedIn})` : ''}`,
-      detail: `${top.join('; ')}${relevant.length > 3 ? `; and ${relevant.length - 3} more` : ''}. ${fixedIn ? `Fixed in ${fixedIn}${fixedIn.startsWith('a release') ? '' : ' or later'}.` : 'Check the advisories for a fixed version.'}${serverOnly ? ` ${serverOnly} of them concern Node.js/server use only and are counted as low.` : ''} Source: GitHub Advisory Database (via npm).`,
-      fix: { kind: 'vuln-dep', name, from: version, to: fixedIn, severity },
+      title: `${name} ${version}: ${relevant.length} known vulnerabilit${relevant.length === 1 ? 'y' : 'ies'}${fixedIn ? ` (fixed in ${fixedIn})` : noFix ? ' (no fixed release)' : ''}`,
+      detail: `${top.join('; ')}${relevant.length > 3 ? `; and ${relevant.length - 3} more` : ''}. ${fixedIn ? `Fixed in ${fixedIn}${fixedIn.startsWith('a release') ? '' : ' or later'}.` : noFix ? `No fixed release exists yet (the latest is ${newest}): replace it, or make sure it never handles untrusted input.` : 'Check the advisories for a fixed version.'}${serverOnly ? ` ${serverOnly} of them concern Node.js/server use only and are counted as low.` : ''} Source: GitHub Advisory Database (via npm).`,
+      fix: { kind: 'vuln-dep', name, from: version, to: fixedIn, noFix, latest: newest || null, severity },
     });
   }
   return findings;