nativekeel 0.1.19 → 0.1.21

package/README.md

@@ -6,7 +6,7 @@ Health check for React Native and Expo apps. One command, no install, no account
 npx nativekeel
 ```
 
-**What's new in 0.1.19:** better plans for apps that are far behind: library targets that fit the React Native you have, not the latest. **0.1.18:** the upgrade plan only suggests library versions your current React Native supports, moves React Navigation and RN Firebase packages together, and says plainly when a vulnerable package has no fixed release. Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 450+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
+**What's new in 0.1.21:** corrected 16 KB page dates: Google Play blocks updates without them from 1 February 2027 (high until then). **0.1.20:** warns about `ImageBackground`, `SafeAreaView`, `DrawerLayoutAndroid` and `UTFSequence`, which React Native has deprecated and will remove (143 of 470 apps we test import one). Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 450+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
 
 ```
 Summary  4 critical · 5 high · 4 medium · 6 low
@@ -30,7 +30,7 @@ Start here
 - **Will Google Play and the App Store accept your next build?** `targetSdk`, 16 KB memory pages (it also opens your built APK/AAB and checks every native library), the iOS privacy manifest, and missing Info.plist usage descriptions.
 
 **Crashes**
-- **Will it crash at runtime?** Reanimated without its Babel plugin or `react-native-worklets`, mixed `@react-native-firebase/*` or `@react-navigation/*` majors, a second copy of React or React Native inside a dependency, Kotlin modules that cannot load through the New Architecture interop layer, AppDelegate setups that crash in Release, camera/photos/location access without the Info.plist text iOS requires, imports of APIs removed from React Native core (`AsyncStorage`, `Picker`, `ViewPropTypes`, …), and traps learned from real upgrades.
+- **Will it crash at runtime?** Reanimated without its Babel plugin or `react-native-worklets`, mixed `@react-native-firebase/*` or `@react-navigation/*` majors, a second copy of React or React Native inside a dependency, Kotlin modules that cannot load through the New Architecture interop layer, AppDelegate setups that crash in Release, camera/photos/location access without the Info.plist text iOS requires, imports of APIs removed from React Native core (`AsyncStorage`, `Picker`, `ViewPropTypes`, …) or deprecated for removal (`ImageBackground`, `SafeAreaView`), and traps learned from real upgrades.
 
 **Security, grouped by OWASP MASVS**
 - **Secrets in the app or the repo:** AWS, Stripe, OpenAI, Anthropic, GitHub, Slack, SendGrid, Twilio, Shopify, Google OAuth and Supabase `service_role` keys, private keys, `.env` values compiled into the bundle, Expo `extra`/`EXPO_PUBLIC_`/`eas.json` secrets, signing keys and passwords.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nativekeel",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Health check for React Native and Expo apps: upgrade blockers, store deadlines, crash risks, vulnerable dependencies and leaked secrets, with a step-by-step upgrade plan.",
   "type": "module",
   "bin": {

package/src/analyze.js

@@ -218,7 +218,7 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
         severity: 'critical',
         area: 'store',
         title: `targetSdk ${target}: Google Play will reject your next update`,
-        detail: `Since ${updates.since} new apps and updates must target API ${updates.minimum}+ (extension possible until ${updates.extensionUntil}).`,
+        detail: `Since ${updates.since} new apps and updates must target API ${updates.minimum}+${today <= updates.extensionUntil ? ` (an extension you request in Play Console runs until ${updates.extensionUntil} at the latest)` : '; the extension period has ended'}.`,
         fix: { kind: 'target-sdk', from: target, to: updates.minimum },
       });
     }

package/src/expo-pins.js

@@ -11,6 +11,7 @@ const EXPO_PINNED = new Set([
   '@react-native-async-storage/async-storage', '@react-native-community/datetimepicker', '@react-native-community/slider',
   '@react-native-community/netinfo', '@react-native-picker/picker', '@react-native-masked-view/masked-view',
   'lottie-react-native', '@shopify/flash-list', '@shopify/react-native-skia', '@stripe/stripe-react-native',
+  '@react-native-segmented-control/segmented-control', '@sentry/react-native', 'react-native-bootsplash',
 ]);
 
 export function expoPinnedNames(root) {

package/src/native.js

@@ -55,15 +55,19 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
   const hasAndroid = fs.existsSync(path.join(root, 'android'));
 
   // 16 KB page size: React Native itself before 0.77, then the actual built binaries.
+  const blocked16k = today >= PAGE_SIZE_16K.blockedFrom;
+  const policy16k = blocked16k
+    ? `Google Play blocks updates without 16 KB page support since ${PAGE_SIZE_16K.blockedFrom}.`
+    : `Google Play requires 16 KB page support for apps targeting Android 15+ (since ${PAGE_SIZE_16K.since}). Play Console warns now, and from ${PAGE_SIZE_16K.blockedFrom} it blocks updates without it.`;
   if (hasAndroid || project.managed) {
     if (rn !== null && rn < PAGE_SIZE_16K.firstRnMinor && today >= PAGE_SIZE_16K.since) {
       add({
         id: 'android-16kb-rn',
-        severity: 'critical',
+        severity: blocked16k ? 'critical' : 'high',
         area: 'store',
         title: `React Native ${project.rnVersion} does not support 16 KB memory pages`,
-        detail: `Google Play rejects updates without 16 KB page support since ${PAGE_SIZE_16K.since} (extensions ended ${PAGE_SIZE_16K.extensionUntil}). React Native supports it from 0.${PAGE_SIZE_16K.firstRnMinor}${project.expoVersion ? ', which in Expo means SDK 53 or later (SDK 52 ships React Native 0.76)' : ''}.`,
-        fix: { kind: 'upgrade-rn-min', to: `0.${PAGE_SIZE_16K.firstRnMinor}.0` },
+        detail: `${policy16k} React Native supports it from 0.${PAGE_SIZE_16K.firstRnMinor}${project.expoVersion ? ', which in Expo means SDK 53 or later (SDK 52 ships React Native 0.76)' : ''}.`,
+        fix: { kind: 'upgrade-rn-min', to: `0.${PAGE_SIZE_16K.firstRnMinor}.0`, blocked: blocked16k, blockedFrom: PAGE_SIZE_16K.blockedFrom },
       });
     }
     const artifact = findBuiltArtifact(root);
@@ -82,11 +86,11 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
         if (relevant.length) {
           add({
             id: 'android-16kb-libs',
-            severity: isRelease ? 'critical' : 'high',
+            severity: isRelease && blocked16k ? 'critical' : 'high',
             area: 'store',
             title: `${libs.length} native librar${libs.length === 1 ? 'y is' : 'ies are'} not 16 KB aligned (${rel})`,
-            detail: `${libs.slice(0, 6).join(', ')}${libs.length > 6 ? ', …' : ''}. Google Play rejects updates containing them. Update the package that ships each library, or rebuild it with NDK r28+.`,
-            fix: { kind: 'align-16kb', libs },
+            detail: `${libs.slice(0, 6).join(', ')}${libs.length > 6 ? ', …' : ''}. ${policy16k} Update the package that ships each library, or rebuild it with NDK r28+.`,
+            fix: { kind: 'align-16kb', libs, blocked: blocked16k, blockedFrom: PAGE_SIZE_16K.blockedFrom },
           });
         } else {
           const ignored = result.misaligned.length;

package/src/plan.js

@@ -258,10 +258,13 @@ export function buildPlan(result) {
   } else if (privacy) {
     storeSteps.push('Add `PrivacyInfo.xcprivacy` to the iOS app target. Start from the file in the React Native template and declare the required-reason APIs your app and SDKs use (UserDefaults, file timestamps, system boot time, disk space).');
   }
-  if (byKind('upgrade-rn-min').length) {
+  const min16k = byKind('upgrade-rn-min')[0];
+  const when16k = min16k && min16k.blocked ? 'Google Play rejects updates until' : `From ${min16k ? min16k.blockedFrom : ''} Google Play rejects updates until`;
+  const by16k = min16k && min16k.blocked ? 'before your next Play release' : `before ${min16k ? min16k.blockedFrom : ''}`;
+  if (min16k) {
     storeSteps.push(isExpo
-      ? '**16 KB memory pages:** Google Play rejects updates until the app is on Expo SDK 53 (React Native 0.79) or later. The Expo SDK phase below gets you there; reach SDK 53 before your next Play release.'
-      : '**16 KB memory pages:** Google Play rejects updates until the app is on React Native 0.77 or later. The React Native phase below gets you there; reach 0.77 before your next Play release.');
+      ? `**16 KB memory pages:** ${when16k} the app is on Expo SDK 53 (React Native 0.79) or later. The Expo SDK phase below gets you there; reach SDK 53 ${by16k}.`
+      : `**16 KB memory pages:** ${when16k} the app is on React Native 0.77 or later. The React Native phase below gets you there; reach 0.77 ${by16k}.`);
   }
   const align = byKind('align-16kb')[0];
   if (align) {
@@ -315,6 +318,7 @@ export function buildPlan(result) {
   for (const p of byKind('patch-version')) {
     cleanup.push(`\`patches/${p.file}\` targets ${p.pkg} ${p.version} but ${p.installed} is installed: check whether the fix is still needed, then recreate or delete it.`);
   }
+  for (const d of byKind('deprecated-core')) cleanup.push(d.step);
   if (byKind('podfile-cli-require').length) {
     cleanup.push("Delete `require_relative '../node_modules/@react-native-community/cli-platform-ios/native_modules'` from `ios/Podfile`; `use_native_modules!` comes from React Native.");
   }

package/src/rules.js

@@ -26,10 +26,11 @@ export const PLAY_TARGET_SDK = {
   visibility: { minimum: 35, since: '2026-08-31' },
 };
 
-// Google Play 16 KB memory page size requirement for apps targeting Android 15+.
-// https://android-developers.googleblog.com/2025/05/prepare-play-apps-for-devices-with-16kb-page-size.html
+// Google Play 16 KB memory page size requirement for apps targeting Android 15+: policy since
+// 2025-11-01; Play blocks updates without it from 2027-02-01 (checked 2026-10-06 on
+// https://developer.android.com/guide/practices/page-sizes, page updated 2026-09-16).
 // React Native supports 16 KB pages from 0.77.
-export const PAGE_SIZE_16K = { since: '2025-11-01', extensionUntil: '2026-05-31', firstRnMinor: 77 };
+export const PAGE_SIZE_16K = { since: '2025-11-01', blockedFrom: '2027-02-01', firstRnMinor: 77 };
 
 // Minimum OS versions of current React Native (since 0.76).
 // https://reactnative.dev/blog/2024/10/23/release-0.76-new-architecture

package/src/stability.js

@@ -277,10 +277,19 @@ const REMOVED_FROM_CORE = {
   ART: 'react-native-svg',
 };
 const REMOVED_PROP_TYPES = ['ViewPropTypes', 'ColorPropType', 'EdgeInsetsPropType', 'PointPropType'];
+// Deprecated in core and announced for removal (RN index.js warnOnce, checked 0.78-0.87).
+// They still work; moving now avoids a crash when they are removed.
+const DEPRECATED_IN_CORE = {
+  SafeAreaView: { since: 81, use: 'react-native-safe-area-context' },
+  ImageBackground: { since: 87, use: 'a View with an absolutely positioned Image' },
+  DrawerLayoutAndroid: { since: 87, use: 'react-native-drawer-layout' },
+  UTFSequence: { since: 87, use: "Unicode escapes written directly (e.g. '\\ufeff')" },
+};
 
 export function removedCoreImports(project) {
   const root = project.root;
   const used = new Map(); // name -> first file:line
+  const deprecated = new Map();
   const files = [];
   const walk = (dir) => {
     let entries = [];
@@ -308,17 +317,31 @@ export function removedCoreImports(project) {
     for (const b of blocks) {
       for (const raw of b.names.split(',')) {
         const name = raw.trim().replace(/^type\s+/, '').split(/\s+as\s+/)[0].trim();
-        if ((REMOVED_FROM_CORE[name] || REMOVED_PROP_TYPES.includes(name)) && !used.has(name)) {
-          used.set(name, `${path.relative(root, file)}:${text.slice(0, b.index).split('\n').length}`);
-        }
+        const at = () => `${path.relative(root, file)}:${text.slice(0, b.index).split('\n').length}`;
+        if ((REMOVED_FROM_CORE[name] || REMOVED_PROP_TYPES.includes(name)) && !used.has(name)) used.set(name, at());
+        if (DEPRECATED_IN_CORE[name] && !deprecated.has(name)) deprecated.set(name, at());
       }
     }
   }
-  if (!used.size) return [];
   const minor = project.rnVersion ? Number(project.rnVersion.split('.')[1]) : null;
+  const findings = [];
+  if (deprecated.size) {
+    const names = [...deprecated.keys()];
+    const warnsNow = minor !== null && names.some((n) => minor >= DEPRECATED_IN_CORE[n].since);
+    findings.push({
+      id: 'deprecated-core-imports',
+      severity: 'low',
+      area: 'react-native',
+      title: `${names.join(', ')} ${names.length === 1 ? 'is' : 'are'} deprecated in React Native core and will be removed`,
+      detail: `${[...deprecated].map(([n, at]) => `${n} (${at}, deprecated in 0.${DEPRECATED_IN_CORE[n].since}) → ${DEPRECATED_IN_CORE[n].use}`).join('; ')}. ${warnsNow ? 'They already log a deprecation warning.' : 'They start logging a warning when you upgrade.'} Once removed, the import returns undefined and the screen crashes, so move off them while it is a small change.`,
+      fix: { kind: 'deprecated-core', step: `Replace ${names.map((n) => `\`${n}\` (→ ${DEPRECATED_IN_CORE[n].use})`).join(', ')} before React Native removes ${names.length === 1 ? 'it' : 'them'}.` },
+    });
+  }
+  if (!used.size) return findings;
   const crashesNow = [...used.keys()].some((n) => (REMOVED_PROP_TYPES.includes(n) ? minor >= 74 : minor >= 72));
   const list = [...used].map(([n, at]) => `${n} (${at}) → ${REMOVED_FROM_CORE[n] || 'deprecated-react-native-prop-types'}`);
   return [
+    ...findings,
     {
       id: 'crash-removed-core-imports',
       severity: crashesNow ? 'high' : 'medium',