nativekeel 0.1.20 → 0.1.22

package/README.md

@@ -6,7 +6,7 @@ Health check for React Native and Expo apps. One command, no install, no account
 npx nativekeel
 ```
 
-**What's new in 0.1.20:** warns about `ImageBackground`, `SafeAreaView`, `DrawerLayoutAndroid` and `UTFSequence`, which React Native has deprecated and will remove (143 of 470 apps we test import one). **0.1.19:** better plans for apps that are far behind: library targets that fit the React Native you have, not the latest. Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 450+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
+**What's new in 0.1.22:** auth tokens in AsyncStorage/MMKV are found by what is stored, not only by the key name. **0.1.21:** corrected 16 KB page dates: Google Play blocks updates without them from 1 February 2027 (high until then). Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 470 open-source React Native and Expo apps to keep false alarms out ([what we found in them](https://dev.to/keel_alican_akyol/we-scanned-470-open-source-react-native-apps-here-is-what-breaks-them-5072)). [All releases →](https://nativekeel.com/changelog)
 
 ```
 Summary  4 critical · 5 high · 4 medium · 6 low

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nativekeel",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "Health check for React Native and Expo apps: upgrade blockers, store deadlines, crash risks, vulnerable dependencies and leaked secrets, with a step-by-step upgrade plan.",
   "type": "module",
   "bin": {

package/src/native.js

@@ -55,15 +55,19 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
   const hasAndroid = fs.existsSync(path.join(root, 'android'));
 
   // 16 KB page size: React Native itself before 0.77, then the actual built binaries.
+  const blocked16k = today >= PAGE_SIZE_16K.blockedFrom;
+  const policy16k = blocked16k
+    ? `Google Play blocks updates without 16 KB page support since ${PAGE_SIZE_16K.blockedFrom}.`
+    : `Google Play requires 16 KB page support for apps targeting Android 15+ (since ${PAGE_SIZE_16K.since}). Play Console warns now, and from ${PAGE_SIZE_16K.blockedFrom} it blocks updates without it.`;
   if (hasAndroid || project.managed) {
     if (rn !== null && rn < PAGE_SIZE_16K.firstRnMinor && today >= PAGE_SIZE_16K.since) {
       add({
         id: 'android-16kb-rn',
-        severity: 'critical',
+        severity: blocked16k ? 'critical' : 'high',
         area: 'store',
         title: `React Native ${project.rnVersion} does not support 16 KB memory pages`,
-        detail: `Google Play rejects updates without 16 KB page support since ${PAGE_SIZE_16K.since} (extensions ended ${PAGE_SIZE_16K.extensionUntil}). React Native supports it from 0.${PAGE_SIZE_16K.firstRnMinor}${project.expoVersion ? ', which in Expo means SDK 53 or later (SDK 52 ships React Native 0.76)' : ''}.`,
-        fix: { kind: 'upgrade-rn-min', to: `0.${PAGE_SIZE_16K.firstRnMinor}.0` },
+        detail: `${policy16k} React Native supports it from 0.${PAGE_SIZE_16K.firstRnMinor}${project.expoVersion ? ', which in Expo means SDK 53 or later (SDK 52 ships React Native 0.76)' : ''}.`,
+        fix: { kind: 'upgrade-rn-min', to: `0.${PAGE_SIZE_16K.firstRnMinor}.0`, blocked: blocked16k, blockedFrom: PAGE_SIZE_16K.blockedFrom },
       });
     }
     const artifact = findBuiltArtifact(root);
@@ -82,11 +86,11 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
         if (relevant.length) {
           add({
             id: 'android-16kb-libs',
-            severity: isRelease ? 'critical' : 'high',
+            severity: isRelease && blocked16k ? 'critical' : 'high',
             area: 'store',
             title: `${libs.length} native librar${libs.length === 1 ? 'y is' : 'ies are'} not 16 KB aligned (${rel})`,
-            detail: `${libs.slice(0, 6).join(', ')}${libs.length > 6 ? ', …' : ''}. Google Play rejects updates containing them. Update the package that ships each library, or rebuild it with NDK r28+.`,
-            fix: { kind: 'align-16kb', libs },
+            detail: `${libs.slice(0, 6).join(', ')}${libs.length > 6 ? ', …' : ''}. ${policy16k} Update the package that ships each library, or rebuild it with NDK r28+.`,
+            fix: { kind: 'align-16kb', libs, blocked: blocked16k, blockedFrom: PAGE_SIZE_16K.blockedFrom },
           });
         } else {
           const ignored = result.misaligned.length;

package/src/plan.js

@@ -258,10 +258,13 @@ export function buildPlan(result) {
   } else if (privacy) {
     storeSteps.push('Add `PrivacyInfo.xcprivacy` to the iOS app target. Start from the file in the React Native template and declare the required-reason APIs your app and SDKs use (UserDefaults, file timestamps, system boot time, disk space).');
   }
-  if (byKind('upgrade-rn-min').length) {
+  const min16k = byKind('upgrade-rn-min')[0];
+  const when16k = min16k && min16k.blocked ? 'Google Play rejects updates until' : `From ${min16k ? min16k.blockedFrom : ''} Google Play rejects updates until`;
+  const by16k = min16k && min16k.blocked ? 'before your next Play release' : `before ${min16k ? min16k.blockedFrom : ''}`;
+  if (min16k) {
     storeSteps.push(isExpo
-      ? '**16 KB memory pages:** Google Play rejects updates until the app is on Expo SDK 53 (React Native 0.79) or later. The Expo SDK phase below gets you there; reach SDK 53 before your next Play release.'
-      : '**16 KB memory pages:** Google Play rejects updates until the app is on React Native 0.77 or later. The React Native phase below gets you there; reach 0.77 before your next Play release.');
+      ? `**16 KB memory pages:** ${when16k} the app is on Expo SDK 53 (React Native 0.79) or later. The Expo SDK phase below gets you there; reach SDK 53 ${by16k}.`
+      : `**16 KB memory pages:** ${when16k} the app is on React Native 0.77 or later. The React Native phase below gets you there; reach 0.77 ${by16k}.`);
   }
   const align = byKind('align-16kb')[0];
   if (align) {

package/src/rules.js

@@ -26,10 +26,11 @@ export const PLAY_TARGET_SDK = {
   visibility: { minimum: 35, since: '2026-08-31' },
 };
 
-// Google Play 16 KB memory page size requirement for apps targeting Android 15+.
-// https://android-developers.googleblog.com/2025/05/prepare-play-apps-for-devices-with-16kb-page-size.html
+// Google Play 16 KB memory page size requirement for apps targeting Android 15+: policy since
+// 2025-11-01; Play blocks updates without it from 2027-02-01 (checked 2026-10-06 on
+// https://developer.android.com/guide/practices/page-sizes, page updated 2026-09-16).
 // React Native supports 16 KB pages from 0.77.
-export const PAGE_SIZE_16K = { since: '2025-11-01', extensionUntil: '2026-05-31', firstRnMinor: 77 };
+export const PAGE_SIZE_16K = { since: '2025-11-01', blockedFrom: '2027-02-01', firstRnMinor: 77 };
 
 // Minimum OS versions of current React Native (since 0.76).
 // https://reactnative.dev/blog/2024/10/23/release-0.76-new-architecture

package/src/security.js

@@ -569,10 +569,24 @@ export function weakCrypto(root) {
 export function tokenStorage(root) {
   const hits = [];
   for (const file of jsFiles(root)) {
+    // Web-only files (keychain.web.ts) have no Keychain to use; the mobile file decides.
+    if (/\.web\.[cm]?[jt]sx?$/.test(file)) continue;
     const text = read(file);
     if (!text || !/AsyncStorage|MMKV/.test(text)) continue;
+    const at = (i) => `${path.relative(root, file)}:${text.slice(0, i).split('\n').length}`;
+    const seen = new Set();
+    // By key name: setItem('access_token', …)
     for (const m of text.matchAll(/\b(?:AsyncStorage\.setItem|storage\.set|mmkv\.set)\s*\(\s*['"`@]?([\w@.\-:]*?(?:access_?token|refresh_?token|auth_?token|id_?token|jwt|session_?token|bearer)[\w.\-:]*)['"`]?\s*,/gi)) {
-      hits.push(`${m[1]} (${path.relative(root, file)}:${text.slice(0, m.index).split('\n').length})`);
+      seen.add(m.index);
+      hits.push(`${m[1]} (${at(m.index)})`);
+    }
+    // By value: setItem(TOKEN_KEY, token), setItem('user', JSON.stringify({ token })). Push
+    // notification and device tokens are not secrets.
+    for (const m of text.matchAll(/\b(?:AsyncStorage\.setItem|(?:storage|mmkv)\.set(?:String)?)\s*\(\s*([^,()]{1,60}),\s*([^;\n]{0,120})/g)) {
+      if (seen.has(m.index)) continue;
+      if (!/\b(?:access_?token|refresh_?token|auth_?token|id_?token|session_?token|login_?token|accessToken|refreshToken|authToken|idToken|sessionToken|loginToken|jwt|token)\b/i.test(m[2])) continue;
+      if (/push|fcm|apns|expo_?push|notif|device|firebase|messaging/i.test(m[1] + m[2])) continue;
+      hits.push(`${m[1].trim()} (${at(m.index)})`);
     }
   }
   if (!hits.length) return [];