nativekeel 0.1.18 → 0.1.20

package/README.md

@@ -6,7 +6,7 @@ Health check for React Native and Expo apps. One command, no install, no account
 npx nativekeel
 ```
 
-**What's new in 0.1.18:** the upgrade plan only suggests library versions your current React Native supports, moves React Navigation and RN Firebase packages together, and says plainly when a vulnerable package has no fixed release. **0.1.17:** every vulnerable package shows the version that fixes it; Expo apps get one line for the packages the SDK upgrade moves. Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 450+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
+**What's new in 0.1.20:** warns about `ImageBackground`, `SafeAreaView`, `DrawerLayoutAndroid` and `UTFSequence`, which React Native has deprecated and will remove (143 of 470 apps we test import one). **0.1.19:** better plans for apps that are far behind: library targets that fit the React Native you have, not the latest. Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 450+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
 
 ```
 Summary  4 critical · 5 high · 4 medium · 6 low
@@ -30,7 +30,7 @@ Start here
 - **Will Google Play and the App Store accept your next build?** `targetSdk`, 16 KB memory pages (it also opens your built APK/AAB and checks every native library), the iOS privacy manifest, and missing Info.plist usage descriptions.
 
 **Crashes**
-- **Will it crash at runtime?** Reanimated without its Babel plugin or `react-native-worklets`, mixed `@react-native-firebase/*` or `@react-navigation/*` majors, a second copy of React or React Native inside a dependency, Kotlin modules that cannot load through the New Architecture interop layer, AppDelegate setups that crash in Release, camera/photos/location access without the Info.plist text iOS requires, imports of APIs removed from React Native core (`AsyncStorage`, `Picker`, `ViewPropTypes`, …), and traps learned from real upgrades.
+- **Will it crash at runtime?** Reanimated without its Babel plugin or `react-native-worklets`, mixed `@react-native-firebase/*` or `@react-navigation/*` majors, a second copy of React or React Native inside a dependency, Kotlin modules that cannot load through the New Architecture interop layer, AppDelegate setups that crash in Release, camera/photos/location access without the Info.plist text iOS requires, imports of APIs removed from React Native core (`AsyncStorage`, `Picker`, `ViewPropTypes`, …) or deprecated for removal (`ImageBackground`, `SafeAreaView`), and traps learned from real upgrades.
 
 **Security, grouped by OWASP MASVS**
 - **Secrets in the app or the repo:** AWS, Stripe, OpenAI, Anthropic, GitHub, Slack, SendGrid, Twilio, Shopify, Google OAuth and Supabase `service_role` keys, private keys, `.env` values compiled into the bundle, Expo `extra`/`EXPO_PUBLIC_`/`eas.json` secrets, signing keys and passwords.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nativekeel",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "Health check for React Native and Expo apps: upgrade blockers, store deadlines, crash risks, vulnerable dependencies and leaked secrets, with a step-by-step upgrade plan.",
   "type": "module",
   "bin": {

package/src/analyze.js

@@ -218,7 +218,7 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
         severity: 'critical',
         area: 'store',
         title: `targetSdk ${target}: Google Play will reject your next update`,
-        detail: `Since ${updates.since} new apps and updates must target API ${updates.minimum}+ (extension possible until ${updates.extensionUntil}).`,
+        detail: `Since ${updates.since} new apps and updates must target API ${updates.minimum}+${today <= updates.extensionUntil ? ` (an extension you request in Play Console runs until ${updates.extensionUntil} at the latest)` : '; the extension period has ended'}.`,
         fix: { kind: 'target-sdk', from: target, to: updates.minimum },
       });
     }

package/src/expo-pins.js

@@ -11,6 +11,7 @@ const EXPO_PINNED = new Set([
   '@react-native-async-storage/async-storage', '@react-native-community/datetimepicker', '@react-native-community/slider',
   '@react-native-community/netinfo', '@react-native-picker/picker', '@react-native-masked-view/masked-view',
   'lottie-react-native', '@shopify/flash-list', '@shopify/react-native-skia', '@stripe/stripe-react-native',
+  '@react-native-segmented-control/segmented-control', '@sentry/react-native', 'react-native-bootsplash',
 ]);
 
 export function expoPinnedNames(root) {

package/src/plan.js

@@ -177,6 +177,8 @@ export function buildPlan(result) {
   const pm = isExpo ? { ...basePm, add: 'npx expo install' } : basePm;
   const pinned = isExpo ? expoPinnedNames(result.project.root) : new Set();
   const movesWithExpo = (name) => isExpo && movesWithExpoSdk(name, pinned);
+  // Packages the React Native upgrade steps move (React Native itself and the compatibility tables).
+  const movesWithRn = (name) => !isExpo && !!byKind('upgrade-rn').length && (name === 'react-native' || !!COMPAT[name]);
   const installed = new Set(result.deps.map((d) => d.name));
   const byKind = (kind) => result.findings.filter((f) => f.fix && f.fix.kind === kind).map((f) => f.fix);
   const phases = [];
@@ -290,7 +292,7 @@ export function buildPlan(result) {
     } else if (f.fix.kind === 'vuln-dep' && (f.fix.severity === 'critical' || f.fix.severity === 'high')) {
       const v = f.fix;
       if (v.noFix) sec.push({ sev, step: `\`${v.name}\` ${v.from} has ${v.severity} known vulnerabilities and no fixed release (the latest is ${v.latest}): replace it, or make sure it never handles untrusted input.` });
-      else sec.push({ sev, step: `Update \`${v.name}\` ${v.from}${v.to ? ` to ${v.to}${v.to.startsWith('a release') ? '' : ' or later'}` : ''}: it has ${v.severity} known vulnerabilities. ${movesWithExpo(v.name) ? 'Expo pins it: the SDK upgrade below moves it.' : 'Check its changelog for breaking changes.'}` });
+      else sec.push({ sev, step: `Update \`${v.name}\` ${v.from}${v.to ? ` to ${v.to}${v.to.startsWith('a release') ? '' : ' or later'}` : ''}: it has ${v.severity} known vulnerabilities. ${movesWithExpo(v.name) ? 'Expo pins it: the SDK upgrade below moves it.' : movesWithRn(v.name) ? 'The React Native steps below move it past this version; if you ship before them, update it now.' : 'Check its changelog for breaking changes.'}` });
     }
   }
   const securitySteps = sec.sort((a, b) => a.sev - b.sev).map((x) => x.step);
@@ -313,6 +315,7 @@ export function buildPlan(result) {
   for (const p of byKind('patch-version')) {
     cleanup.push(`\`patches/${p.file}\` targets ${p.pkg} ${p.version} but ${p.installed} is installed: check whether the fix is still needed, then recreate or delete it.`);
   }
+  for (const d of byKind('deprecated-core')) cleanup.push(d.step);
   if (byKind('podfile-cli-require').length) {
     cleanup.push("Delete `require_relative '../node_modules/@react-native-community/cli-platform-ios/native_modules'` from `ios/Podfile`; `use_native_modules!` comes from React Native.");
   }
@@ -369,17 +372,21 @@ export function buildPlan(result) {
   // The React Native steps move them further.
   const curMinor = result.project.reactNative ? Number(result.project.reactNative.split('.')[1]) : null;
   const archNow = !byKind('enable-new-arch').length;
+  const rnTarget = byKind('upgrade-rn')[0];
+  const rnBehind = !!(rnTarget && curMinor !== null && Number(rnTarget.to.split('.')[1]) - curMinor >= 3);
   const nativeBumps = byKind('bump-dep')
     .filter((d) => d.native && !movesWithExpo(d.name))
     .map((d) => {
       if (!COMPAT[d.name] || curMinor === null) return d;
       const best = bestRange(d.name, curMinor, archNow);
-      if (!best) return d;
+      if (!best) return null; // the table starts later: the React Native steps move it
       if (compareVersions(d.from, best.from) >= 0 && (!best.to || compareVersions(d.from, best.to) <= 0)) return null;
       if (compareVersions(d.from, best.from) > 0) return null;
       return { ...d, to: best.range, capped: `0.${curMinor}` };
     })
-    .filter(Boolean);
+    .filter(Boolean)
+    // Far behind: the latest release usually needs a newer React Native than the app has.
+    .map((d) => (rnBehind && !d.capped ? { ...d, to: `the newest release that supports React Native 0.${curMinor} (latest is ${d.to})` } : d));
   if (nativeBumps.length) {
     phases.push({
       title: 'Update native modules on the current React Native version',

package/src/stability.js

@@ -277,10 +277,19 @@ const REMOVED_FROM_CORE = {
   ART: 'react-native-svg',
 };
 const REMOVED_PROP_TYPES = ['ViewPropTypes', 'ColorPropType', 'EdgeInsetsPropType', 'PointPropType'];
+// Deprecated in core and announced for removal (RN index.js warnOnce, checked 0.78-0.87).
+// They still work; moving now avoids a crash when they are removed.
+const DEPRECATED_IN_CORE = {
+  SafeAreaView: { since: 81, use: 'react-native-safe-area-context' },
+  ImageBackground: { since: 87, use: 'a View with an absolutely positioned Image' },
+  DrawerLayoutAndroid: { since: 87, use: 'react-native-drawer-layout' },
+  UTFSequence: { since: 87, use: "Unicode escapes written directly (e.g. '\\ufeff')" },
+};
 
 export function removedCoreImports(project) {
   const root = project.root;
   const used = new Map(); // name -> first file:line
+  const deprecated = new Map();
   const files = [];
   const walk = (dir) => {
     let entries = [];
@@ -308,17 +317,31 @@ export function removedCoreImports(project) {
     for (const b of blocks) {
       for (const raw of b.names.split(',')) {
         const name = raw.trim().replace(/^type\s+/, '').split(/\s+as\s+/)[0].trim();
-        if ((REMOVED_FROM_CORE[name] || REMOVED_PROP_TYPES.includes(name)) && !used.has(name)) {
-          used.set(name, `${path.relative(root, file)}:${text.slice(0, b.index).split('\n').length}`);
-        }
+        const at = () => `${path.relative(root, file)}:${text.slice(0, b.index).split('\n').length}`;
+        if ((REMOVED_FROM_CORE[name] || REMOVED_PROP_TYPES.includes(name)) && !used.has(name)) used.set(name, at());
+        if (DEPRECATED_IN_CORE[name] && !deprecated.has(name)) deprecated.set(name, at());
       }
     }
   }
-  if (!used.size) return [];
   const minor = project.rnVersion ? Number(project.rnVersion.split('.')[1]) : null;
+  const findings = [];
+  if (deprecated.size) {
+    const names = [...deprecated.keys()];
+    const warnsNow = minor !== null && names.some((n) => minor >= DEPRECATED_IN_CORE[n].since);
+    findings.push({
+      id: 'deprecated-core-imports',
+      severity: 'low',
+      area: 'react-native',
+      title: `${names.join(', ')} ${names.length === 1 ? 'is' : 'are'} deprecated in React Native core and will be removed`,
+      detail: `${[...deprecated].map(([n, at]) => `${n} (${at}, deprecated in 0.${DEPRECATED_IN_CORE[n].since}) → ${DEPRECATED_IN_CORE[n].use}`).join('; ')}. ${warnsNow ? 'They already log a deprecation warning.' : 'They start logging a warning when you upgrade.'} Once removed, the import returns undefined and the screen crashes, so move off them while it is a small change.`,
+      fix: { kind: 'deprecated-core', step: `Replace ${names.map((n) => `\`${n}\` (→ ${DEPRECATED_IN_CORE[n].use})`).join(', ')} before React Native removes ${names.length === 1 ? 'it' : 'them'}.` },
+    });
+  }
+  if (!used.size) return findings;
   const crashesNow = [...used.keys()].some((n) => (REMOVED_PROP_TYPES.includes(n) ? minor >= 74 : minor >= 72));
   const list = [...used].map(([n, at]) => `${n} (${at}) → ${REMOVED_FROM_CORE[n] || 'deprecated-react-native-prop-types'}`);
   return [
+    ...findings,
     {
       id: 'crash-removed-core-imports',
       severity: crashesNow ? 'high' : 'medium',