High/medium nsp vulnerabilities for dependency ws and hoek #18854

CapitanRedBeard · 2018-04-13T20:19:35Z

Similar to vulnerability issues in the past (here and here), we have 2 outstanding nsp vulnerabilities.
Running nsp check produces the following:

(+) 2 vulnerabilities found
┌────────────┬────────────────────────────────────────────────────────────────────┐
│            │ Denial of Service                                                  │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Name       │ ws                                                                 │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ CVSS       │ 7.5 (High)                                                         │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Installed  │ 2.3.1                                                              │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Vulnerable │ <1.1.5 || >=2.0.0 <3.3.1                                           │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Patched    │ >= 1.1.5 <2.0.0 || >=3.3.1                                         │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Path       │ my-app@0.1.0 > react-native@0.55.2 > react-devtools-core@3.1.0     │
│            │ > ws@2.3.1                                                         │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ More Info  │ https://nodesecurity.io/advisories/550                             │
└────────────┴────────────────────────────────────────────────────────────────────┘

┌────────────┬────────────────────────────────────────────────────────────────────┐
│            │ Prototype pollution attack                                         │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Name       │ hoek                                                               │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ CVSS       │ 4 (Medium)                                                         │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Installed  │ 2.16.3                                                             │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Vulnerable │ <= 4.2.0 || >= 5.0.0 < 5.0.3                                       │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Patched    │ > 4.2.0 < 5.0.0 || >= 5.0.3                                        │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Path       │ my-app@0.1.0 > react-native@0.55.2 > metro@0.30.2 >                │
│            │ jest-haste-map@22.4.2 > sane@2.5.0 > fsevents@1.1.3 >              │
│            │ node-pre-gyp@0.6.39 > hawk@3.1.3 > hoek@2.16.3                     │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ More Info  │ https://nodesecurity.io/advisories/566                             │
└────────────┴────────────────────────────────────────────────────────────────────┘

Environment

Environment:
  OS: macOS Sierra 10.12.6
  Node: 8.9.4
  Yarn: 1.3.2
  npm: 5.6.0
  Watchman: 4.9.0
  Xcode: Xcode 9.2 Build version 9C40b
  Android Studio: 3.0 AI-171.4443003

Packages: (wanted => installed)
  react: ^16.0.0 => 16.2.0
  react-native: ^0.55.0 => 0.55.2

Steps to Reproduce

npm install -g nsp
nsp check

Expected Behavior

(+) 0 vulnerabilities found

Actual Behavior

(+) 2 vulnerabilities found

( Details above )

These are getting picked in the whitesource vulnerability audit, resolving these would be a huge confidence booster.

The text was updated successfully, but these errors were encountered:

CapitanRedBeard · 2018-04-13T20:20:18Z

What's curious in these dependency breadcrumbs is that it looks like react-devtools-core@3.1.0 doesn't even use ws and metro@0.30.2 doesn't even use jest-haste-map.

Summys · 2018-04-14T15:27:02Z

Also check, https://snyk.io/test/github/facebook/react-native

athalay · 2018-05-07T11:21:25Z

Is there a plan/chance to update/remove/change these dependencies to safe versions/ones? We are using react-native, and having these vulnerable dependencies currently blocks us from releasing :/

Rohithzr · 2018-05-08T18:29:58Z

any way to manually fix it? this is my first time facing such an issue.

CapitanRedBeard · 2018-05-08T23:11:16Z

@Rohithzr Sadly this is something that you sort of just have to deal with when using a framework with 1000+ sub dependencies.

If its an absolute must that you have to ship a produce without these security vulnerabilities you can always fork react-native and see if you can perform the upgrades yourself to prevent using versions of packages with known vulnerabilities.

I don't recommend this as it will be near impossible to maintain moving forward, so I think the best option is to just sit tight and bump the thread.

xlcrr · 2018-05-09T12:05:11Z

I am getting the same errors

react-native ^0.55.4 has a dependency of ws@^1.1.0. On npm i I am prompted to run npm audit which returns


┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ ws                                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-native                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-native > react-devtools-core > ws                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/550                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-native                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-native > plist > xmlbuilder > lodash                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/577                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ deep-extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-native                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-native > metro > jest-haste-map > sane > fsevents >    │
│               │ node-pre-gyp > rc > deep-extend                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/612                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

./node_modules/react-native/node_modules/ws/package.json "ws@^1.1.0" <- should I update this ??

Rohithzr · 2018-05-10T06:26:29Z

@CapitanRedBeard maybe i can fix and create a pull request. atleast go past the severe ones.

byCedric · 2018-05-19T15:08:55Z

Currently there are still some issues reported by npm audit (the successor of nsp, available in npm@6). One related to the existing ws issue in react-devtools-core and one in an outdated plist nested-dependency containing a prototype pollution caused by an older version of lodash. Below you can see the exact report.

Regarding the issue of ws, some other developers and I have brought this up in the repository of react-devtools, issue 941. Today I also mentioned this in the forums, so let's hope that one will be picked up soon.

As for the prototype pollution issue, this is caused by an old version of lodash@3.10.1. I've added the exact dependency chain too. Luckily this issue is fixed kind of easy, by simply using plist@>=2.0.0. If desired I can make a PR for this change.

The dependency chain of the lodash prototype pollution issue

<our-project>
└─┬ react-native@0.55.2 (github:expo/react-native#4129853e83eb3381d8f54a2c8e798039fd254aae)
  └─┬ plist@1.2.0
    └─┬ xmlbuilder@4.0.0
      └── lodash@3.10.1

The full audit report report

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ ws                                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >= 1.1.5 <2.0.0 || >=3.3.1                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ de4258aaf4380087dace601ba1b6348491e64509333c2f84855dad0d0e7… │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ de4258aaf4380087dace601ba1b6348491e64509333c2f84855dad0d0e7… │
│               │ > react-devtools-core > ws                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/550                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.5                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ de4258aaf4380087dace601ba1b6348491e64509333c2f84855dad0d0e7… │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ de4258aaf4380087dace601ba1b6348491e64509333c2f84855dad0d0e7… │
│               │ > plist > xmlbuilder > lodash                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/577                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

byCedric · 2018-05-21T18:47:53Z

react-devtools-core's ws security issue has been patched just now starting from >=3.2.2 🎆 Please note that the current react-devtools-core is using a hardcoded 3.1.0, so that should be updated I think. I'll create a PR containing this and the plist update to fix all currently known (non-dev) security issues.

Oraclesports · 2018-05-30T17:17:54Z

Any updates on this?

byCedric · 2018-05-30T17:20:33Z

@Oraclesports see the attached PR, #19373

tetreault · 2018-05-31T18:36:53Z

new to react native, so not really sure what any of the above means as i've never seen it in my normal node projects. I have the exact same output of @byCedric (ws high vulnerability and lodash as a low vulnerability). For react native novices -- is there anything for us to do here or should i just look the other way in regards to this for now?

This only popped up after installing react-navigation v^2.0.4

byCedric · 2018-05-31T18:50:37Z

Haha, well, these security issues live in React Native itself. So I'm guessing our friendly friends from Facebook are really the only one who can resolve this anytime soon. I guess the only thing anyone can do is contacting Facebook, pinging maintainers from the repository or stalking anyone who can speed up the process. Oh, and "welcome to React Native"! 😄

When I created an issue in the official forms they resolved the react-devtools-core's ws issue (partly the cause of these issues here). They resolved the issue over there in about 6 hours. So anyone reading this and thinking "why the hell isn't it merged/fixed already", try flagging this in the forums or any communication channel. Maybe it helps, but for now I would say sit tight.

tetreault · 2018-05-31T19:10:02Z

thanks for the reply! appreciate the info @byCedric :)

Summary: This updates both [`react-devtools-core`](facebook/react-devtools#941) and [`plist`](TooTallNate/plist.js@04c8ee7) to include security fixes, reported by `npm audit`. Fixes facebook#18854 _Only dependencies are updated with security patches, no change in actual code._ _Only dependencies are updated with security patches, no change in actual code._ [GENERAL] [ENHANCEMENT] [react-devtools-core] - Bump to `3.2.2` for a security fix for `ws` [GENERAL] [ENHANCEMENT] [plist] - Bump to `3.0.0` for a security fix for `xmlbuilder` Closes facebook#19373 Reviewed By: sophiebits Differential Revision: D8149200 Pulled By: hramos fbshipit-source-id: 732fd627b232c315be60ed2da432742e8256a38a

Shazam14 · 2018-09-29T04:34:43Z

Ok so until now do we still have to flag them? for support?

Remove _workQueue of webSocket set to NULL which may leads to crash Remove _delegateDispatchQueue nil handler Sync stream event cleanup with SRWebSocket Added operation for unschedule stream from runloop Adjust order of weakSelf Adding `Wrapper` suffix to `EventHandler` and `EventHandler` type names Summary: It's maybe not so important/crucial, but this thing bothers me a lot. We use raw opaque `EventTarget`, `InstanceHandle` and `EventHandler` pointers in application layer quite a lot and we don't have any kind of type-safety here. I believe all those opaque types should be represented as named scalar types which compiler at least can differentiate at compile time. So I propose introducing named aliases for them which will point to particular empty `struct`s. This will allow us to tag types properly in all functions and methods and ensure that we pass right values as right arguments. Again, they are *just aliases*, which are effectively still `void *`, no any additional logic or names are involved. Unfortunately, those nice type names are already taken by `JSIFabricUIManager` local anonymous namespace (even if they are inside anonymous namespace we cannot use them https://stackoverflow.com/questions/3673353/anonymous-namespace-ambiguity). I think it's fair to rename them because... it's local. And we already use `Wrapper` suffix for them anyways. Reviewed By: fkgozali Differential Revision: D8181151 fbshipit-source-id: 9b55b43fb671a56b32a862ac54f78d528e1188ce Export JSExecutor Reviewed By: rzito Differential Revision: D8187754 fbshipit-source-id: e0da3781e2b3e24cef04086d15e3f5394e059d30 Vendor fetch polyfill, remove default blob response type Summary: While investigating an issue about blobs (https://github.com/facebook/react-native/issues/18223), I noticed that the fetch polyfill (https://github.com/github/fetch) uses blobs as the response type by default if the module is available (https://github.com/github/fetch/blob/master/fetch.js#L454). This surfaced some issue with the blob implementation on iOS that has since been fixed. However after further review of the fetch polyfill and the way Blobs work in RN, I noticed a major issue that causes blobs created by fetch to leak memory. This is because RN blobs are not deallocated automatically like in the browser (see comment https://github.com/facebook/react-native/blob/master/Libraries/Blob/Blob.js#L108) and the fetch polyfill does not deallocate them explicitly using the close method. Ideally we should implement automatic blob cleanup when the instance is garbage collected but implementing that is probably somewhat complex as it requires integrating with JSC. For now I suggest disabling the default handling of requests as blobs in the fetch polyfill. This will mitigate the issue for people not using Blobs directly. I'm not sure how well documented the Blob module is but we should make it clear that they currently require explicit deallocation with the close method for people using them directly. Run a simple http request using fetch and make sure it does not use the Blob module anymore. [GENERAL] [BUGFIX] [fetch] - Do not use blobs to handle responses in the fetch polyfill, fixes potential memory leak. Closes https://github.com/facebook/react-native/pull/19333 Differential Revision: D8125463 Pulled By: hramos fbshipit-source-id: 8f4602190dfc2643606606886c698e8e9b1d91d1 Fabric: Using types `EventTarget`, `EventHandler` & co. instead of `void *` everywhere Summary: Nothing actually changed besides type names... which actually helps me found an issue in FabricUIManager! Now there is no a single `void *` in Fabric/C++ and JavaScript bindings. Yay! Reviewed By: fkgozali Differential Revision: D8191420 fbshipit-source-id: b1eb60b6bc34dd25ab200aab854ffbd7ccf5b15d cli: upgrade envinfo for new features in `react-native info` Summary: envinfo has done a good job reporting issues in the issue template so far, and I've done a lot of work between version 3.x and 5.x that react-native could benefit from. This adds: - better information organization, including versions and paths - Platform/CPU/RAM - Android and iOS SDK version detection - npm package globbing (select all babel* packages - global npm packages (with globbing) envinfo also can report IDE versions, other binaries, languages and browsers if needed, and in different formats. Take a look here if interested: https://github.com/tabrindle/envinfo - run `react-native info` // standard info - run `react-native info --packages` // all packages in package.json - run `react-native info --packages jest,eslint,babel-polyfill` // specified packages - run `react-native info --packages *babel*` // globbed packages Sample standard output: ``` System: OS: macOS High Sierra 10.13 CPU: x64 Intel(R) Core(TM) i7-4870HQ CPU @ 2.50GHz Memory: 97.59 MB / 16.00 GB Shell: 5.4.2 - /usr/local/bin/zsh Binaries: Node: 8.11.0 - ~/.nvm/versions/node/v8.11.0/bin/node Yarn: 1.5.1 - ~/.yarn/bin/yarn npm: 5.6.0 - ~/.nvm/versions/node/v8.11.0/bin/npm Watchman: 4.9.0 - /usr/local/bin/watchman SDKs: iOS SDK: Platforms: iOS 11.0, macOS 10.13, tvOS 11.0, watchOS 4.0 Android SDK: Build Tools: 27.0.3 API Levels: 26 IDEs: Android Studio: 3.0 AI-171.4443003 Xcode: 9.0/9A235 - /usr/bin/xcodebuild npmPackages: react: 16.3.2 => 16.3.2 react-native: 0.55.0 => 0.55.0 npmGlobalPackages: create-react-native-app: 1.0.0 react-native-cli: 2.0.1 ``` https://github.com/facebook/react-native/pull/14428 - original inclusion of `react-native info` [CLI] [ENHANCEMENT] [local-cli/info/info.js] - add more info to react-native info cli command, like global npm packages, binary paths, and SDK versions Closes https://github.com/facebook/react-native/pull/19331 Differential Revision: D8049650 Pulled By: hramos fbshipit-source-id: 35c677f369bcad1a014eb083b2ce60ba33fee0ea Update Jest snapshots Summary: Jest will now exclude undefined props from snapshots (https://github.com/facebook/jest/pull/6162). Updating the snapshots should fix the current `test_javascript` failures. Circle CI [INTERNAL][MINOR][Snapshots] - Update snapshots Closes https://github.com/facebook/react-native/pull/19414 Differential Revision: D8125193 Pulled By: hramos fbshipit-source-id: db8dcfcd8afbf9d6256f83c6e922680a7872d776 Add Feature Request template Summary: Closes https://github.com/facebook/react-native/pull/19498 Differential Revision: D8197147 Pulled By: hramos fbshipit-source-id: 0668b885a0eb04a3af948f5643649d5b68488c71 OSS: ignore xcodeproj in root dir Summary: We don't need Xcode project in root dir. Reviewed By: davidaurelio Differential Revision: D8197985 fbshipit-source-id: dbbb8820111e84181c9880372dab9af55e0876e6 jest@23.0.1 in xplat/js Reviewed By: rafeca Differential Revision: D8195559 fbshipit-source-id: 7e96f24ae1f9586e9fbc6e1687f731420979352d deleted UI Action Sheet Delegate Methods Reviewed By: PeteTheHeat Differential Revision: D8191111 fbshipit-source-id: 39867683cf5e0cdf8a94a76269d939b5ecf6bbd4 Fix ART surface sleep issue Summary: Fixes https://github.com/facebook/react-native/issues/17565. Reviewed By: achen1 Differential Revision: D8194925 fbshipit-source-id: 5448d49d959078eaded697f791e1b382471fabdb Fix TextInput's initial layout measurements Reviewed By: mdvacca Differential Revision: D7732819 fbshipit-source-id: 0ca4e5643d2cfefe304d7f189474a671c4bcb31e Fix ReactInstanceManager unmountApplication Reviewed By: mdvacca Differential Revision: D7945746 fbshipit-source-id: 0c2eed9a623e442fa4a4ff29ffa01f025466c9b6 Introducing Scheduling of JS calls from native Reviewed By: achen1 Differential Revision: D7729226 fbshipit-source-id: 9869e0a6a2b0c58b7538836ed2c13a4b28dd8887 Refactor setup of Event Dispatcher Reviewed By: achen1 Differential Revision: D7746311 fbshipit-source-id: cfee1c2ced6d85477628085f3260496e80ae48c2 First implementation of scheduleWork method Reviewed By: shergin Differential Revision: D7799412 fbshipit-source-id: b78a0bc0e80868f6877a31f862d7e6104fd4a049 Deprecate UIManagerModule#getEventDispatcher and refactor usages Reviewed By: shergin Differential Revision: D7832079 fbshipit-source-id: 263a2f8ff96ab6e14b91395644710b4d5f36dc50 store / retrieve instanceHandle from View Reviewed By: shergin, achen1 Differential Revision: D8074014 fbshipit-source-id: aee0d41e0e9da44e8748f47da04dcd76dbe96d8d Include instanceHandle in cloning mechanism Reviewed By: shergin, achen1 Differential Revision: D8072075 fbshipit-source-id: 2fcfdfa5116850ce0bac6c2c86d87e5bf00fd7f0 Binding for js events Reviewed By: fkgozali Differential Revision: D8181616 fbshipit-source-id: 5937c83f22ac09e3041fcb0f8d4e9e3026b2b397 Initialize Event Emitter as part of UIManagerModule Reviewed By: achen1 Differential Revision: D8216184 fbshipit-source-id: 3b188804e2dad2b112f566da49a939eb4338713d Use timestamps from QPL by default Differential Revision: D8207166 fbshipit-source-id: 1e43d6874ee400cb2e26a11cbcfb12ee32d28d3c Upgrade Jest to 23.1.0 Reviewed By: davidaurelio Differential Revision: D8212583 fbshipit-source-id: 245a5ccc9bcd63a0995dcb5a1770a6f5f34cd04e Revert D8194925: Fix ART surface sleep issue Differential Revision: D8194925 Original commit changeset: 5448d49d9590 fbshipit-source-id: c01e11d44424e1f6fb79866bb845ed60764c5f13 Fix jest snapshot testing on windows Summary: Fixes #19370 Applied changes to existing project that uses jest snapshot testing. Testing was broken before and now works. To verify: Run any snapshot test containing an image reference on Windows before and after this PR. [WINDOWS][BUGFIX][jest] - Fixed jest snapshot testing on windows Closes https://github.com/facebook/react-native/pull/19496 Differential Revision: D8195947 Pulled By: hramos fbshipit-source-id: 909b5fe7cfd8c6286baf161a227a359854a37603 Enable webhooks on Circle Summary: Release Notes ============= [INTERNAL][MINOR][CircleCI] - Send webhooks to Facebook. Closes https://github.com/facebook/react-native/pull/19527 Differential Revision: D8228361 Pulled By: hramos fbshipit-source-id: 5d7c0960392b9a860d3f665e2a316c18153879eb Migrate Android sources to MIT license header Reviewed By: fkgozali Differential Revision: D8065619 fbshipit-source-id: 719c303b40c96950bab8e5dde9a75f449b2956c6 Upgrade Metro to 0.37.2 Reviewed By: rafeca Differential Revision: D8223545 fbshipit-source-id: fdaacbb514e2947b9244cb55ef9170af55ba2f60 Rename default RN transformer Differential Revision: D8235001 fbshipit-source-id: 59a4b2f13185dd9be0d33f01589d907d49493a26 Change default metro transformer Differential Revision: D8234984 fbshipit-source-id: 83cecfbfa3300f7703ea197009d985bbbc58127a Bump metro@0.38.0 Reviewed By: davidaurelio Differential Revision: D8235787 fbshipit-source-id: a22802c829920e7e182a9aae70bd69a6446d5f8f Fabric: Integrating `tag` into `EventHandlers` Summary: In order to dispatch event, `EventHandlers` must also know react tag. So we have to store it inside. We plan to illuminate this requirement (and `tag` from `EventHandlers`) eventually. Reviewed By: fkgozali Differential Revision: D8211685 fbshipit-source-id: 2064c0f4a7869cbf4d2c92d0349f4ee3998cb8f5 Fabric: The first version of event dispatching pipeline Summary: This is the first attempt to implement some base part of event dispatching pipeline from end-to-end. Even when it is working, all this is still incomplete and generally up in the air. We are still messing proper implementation of event queue, priority, and synchronization of react reconciliation process with event scheduling. Reviewed By: fkgozali Differential Revision: D8212271 fbshipit-source-id: 92f9427d14726441c70ffff294ac95eeb004152a Fabric: Removed unused type aliases Summary: Trivial. Reviewed By: fkgozali Differential Revision: D8212287 fbshipit-source-id: 228951742568d28a064ee03b6314a4c01532b9c9 Clamp typechecks -> Flow Reviewed By: yungsters Differential Revision: D8219220 fbshipit-source-id: e849d9dae573459e4b09e317cc6dc37bec9ce4e8 RefreshControl ES6 Class Reviewed By: sahrens Differential Revision: D8219221 fbshipit-source-id: 445243964d64dd5274c1e47bdc137645dc8eecaf ActivityIndicator ES6 Class Reviewed By: yungsters Differential Revision: D8219463 fbshipit-source-id: 7d252d15bb4a7345d156b1659b09be2a4a69ba6c DatePickerIOS add onChange event definition Reviewed By: sahrens Differential Revision: D8219622 fbshipit-source-id: 37f26d0981318b7eab9d3c734c44e7714fa6f0e8 DatePickerIOS ES6 Class Reviewed By: sahrens Differential Revision: D8219657 fbshipit-source-id: cef48cf3ad24ad442f07df0edad55ab97d96c6f2 Delete EventDispatcher interface Reviewed By: achen1 Differential Revision: D8232129 fbshipit-source-id: 6d618b4a587c0b0e1dfac967e8d22c05a62c44ee RN: Remove Native Prop Validation Summary: As we migrate over to static typing solutions for props, we cannot rely on always having `propTypes` available at runtime. This gets us started on that journey by removing the native prop validation that happens when we require native components. bypass-lint Reviewed By: TheSavior Differential Revision: D7976854 fbshipit-source-id: f3ab579a7f0f8cfb716b0eb7fd4625f8168f3d96 Bump to BUCK v2018.03.26.01 Summary: Bumps CI to latest BUCK release. Test Plan --------- Run on Circle CI. Release Notes ------------- [INTERNAL] [MINOR] [Tests] - Bump to BUCK v2018.03.26.01 Closes https://github.com/facebook/react-native/pull/19535 Differential Revision: D8240382 Pulled By: hramos fbshipit-source-id: 60812cc90542201b362ef264083dd79dbf5d9360 make logMarker visible for consistency with logTaggedMarker Differential Revision: D8240294 fbshipit-source-id: 8d056dc89adff41ff43c0df2f752b01ac1fb189f react-native-xcode.sh: Support Homebrew-installed nodenv Summary: As well as nvm. https://github.com/facebook/react-native/blob/9d315f4a1e7b0c9cd80a51903db0b1b561b19e33/scripts/react-native-xcode.sh#L56-L60 Build React Native iOS app with Release configuration and run the script using `node` command which is installed through Homebrew-installed `nodenv` and `node-build`. None. [IOS] [ENHANCEMENT] [scripts/react-native-xcode.sh] - Support Homebrew-installed nodenv Closes https://github.com/facebook/react-native/pull/19509 Differential Revision: D8243181 Pulled By: hramos fbshipit-source-id: fbd75f377f4aebf89ce35b96a47c59238e62e9ce Low the priority for logging events in fabric Reviewed By: achen1 Differential Revision: D8238957 fbshipit-source-id: f2e8bd941ac68ead4c5ed7cadfcf83a753e44cab better place for dismiss all button Summary: This pr makes a little bit simpler to dismiss all warnings (1 click instead of 2) Sometimes you don't want to use `YellowBox.ignoreWarnings` to remember. RNTester sceenshot: <img width="322" alt="screen shot 2018-05-30 at 09 51 25" src="https://user-images.githubusercontent.com/1488195/40701475-1142506a-63ef-11e8-8fc9-ea1696d9cb65.png"> Or RNTester -> Native Animation Example -> Force JS Stalls (in the end of the list) also cause warning to test. [GENERAL][ENHANCEMENT][YellowBox] - Move `Dismiss All` yellow box button to another place which makes a little bit simpler to dismiss warnings. Closes https://github.com/facebook/react-native/pull/19501 Differential Revision: D8243823 Pulled By: hramos fbshipit-source-id: 31887469cddb4adfd7b889ae0c29a3bf41e87b7b Slider remove $FlowFixMe Reviewed By: sahrens Differential Revision: D8234803 fbshipit-source-id: cfc0466a54f3c219d8a2eadfebf840399a2abdd8 refactor JSI module initialization Reviewed By: fkgozali Differential Revision: D8111636 fbshipit-source-id: 6e32703b077144962519485002adff8c9f6084ad Add backward compatible support for onLayout event in Fabric Reviewed By: achen1 Differential Revision: D8231722 fbshipit-source-id: 3d0641a7813e742ca81b98576f9ffc30ee597f30 Implement release of FabricUIManager resources Reviewed By: achen1 Differential Revision: D8232155 fbshipit-source-id: 6683c692a830f5a73aab2c606167e54d668ae5c2 normalizeColor to compute regexps lazily Reviewed By: johnislarry Differential Revision: D8241955 fbshipit-source-id: 0939f442bb1e51118207449e0b95c6da97b899da Revert D8234803: [RN] Slider remove $FlowFixMe Differential Revision: D8234803 Original commit changeset: cfc0466a54f3 fbshipit-source-id: 354fcc1853597cbcd518abaf4be5b11116f594b3 Slider remove $FlowFixMe #take2 Reviewed By: fkgozali Differential Revision: D8246336 fbshipit-source-id: 21555a318bd823309ac2c285b49c2045338c2b28 Slider move prop comments to flow types Reviewed By: yungsters Differential Revision: D8246378 fbshipit-source-id: f62a77d64016f6502b3445ab6d0d1558034333e6 Slider to ES6 Class Reviewed By: yungsters Differential Revision: D8246422 fbshipit-source-id: 1955ae87abe077115ac8f8ea105be85db8ea66b4 Switch to ES6 Class Reviewed By: yungsters Differential Revision: D8246980 fbshipit-source-id: fbd6998429e6791000ea093d3fa15c1a486914bd Remove duplicated attachWebsocketServer module Reviewed By: jeanlauliac Differential Revision: D8248752 fbshipit-source-id: b829de4b0d75d154dd80196b589fe70b0050be4d Bump metro@0.38.1 Reviewed By: jeanlauliac Differential Revision: D8248753 fbshipit-source-id: aa6d0da4e96e8b4109b6b5bca050614ec1860fc2 Trigger nested VirtualizedLists to re-measure if their containing cell's onLayout fires Reviewed By: sahrens Differential Revision: D8272040 fbshipit-source-id: c490ffa875bfd0547ac54d214c5ebbeb23c99942 skip dismiss all if all rows are hidden (#19564) Summary: Small fix based on https://github.com/facebook/react-native/pull/19501#issuecomment-394486884 No need to mention it [GENERAL] [BUGFIX] [YellowBox] - Message Closes https://github.com/facebook/react-native/pull/19564 Differential Revision: D8276808 Pulled By: hramos fbshipit-source-id: 59832d3d6e60ae30afbeb7c9303405746e9eec45 Fix events not working after closing and navigating back to Fabric screen in FB4A Reviewed By: fkgozali Differential Revision: D8240344 fbshipit-source-id: 992945f94843589cefdf7ea24da709449ee38778 Enable proguard for Fabric in release builds Reviewed By: shergin Differential Revision: D8247814 fbshipit-source-id: 94ed8a767fcf4f6093646618a5691ff17753ffe0 Use correct library reference for libfishhook.a in RCTWebSocket (#19579) Summary: This uses the reference for `libfishhook.a` from the Products, rather than the reference from the Frameworks group. This fixes the build for the new Xcode build system, on both Xcode 9 and Xcode 10. Fixes #19569 - Using Xcode 10: - Open `RNTester/RNTester.xcodeproj` - Build RNTester, noting build errors - Using Xcode 9: - Open `RNTester/RNTester.xcodeproj` - Switch to using new build system in `File > Project Settings > Build System`, selecting `New Build System (Preview)` - Build RNTester, noting build errors none [IOS] [BUGFIX] [RCTWebSocket] - Fix build for new Xcode build system Closes https://github.com/facebook/react-native/pull/19579 Differential Revision: D8287487 Pulled By: hramos fbshipit-source-id: 5bfc9decb09ebc763824df8474b5897099d39ad7 Add open source Flow declaration for Metro module Summary: Fix Flow failure by adding a declaration to the Flow config used in open source. This did not get caught internally because we use a different Flow config. Release Notes ------------- [INTERNAL] [MINOR] [Flow] - Fix Flow config. Reviewed By: rafeca Differential Revision: D8257641 fbshipit-source-id: 3f4b2cbe622b2e76aa018e9369216a6b9ac25f47 Fix/security issues (#19373) Summary: This updates both [`react-devtools-core`](https://github.com/facebook/react-devtools/issues/941) and [`plist`](https://github.com/TooTallNate/plist.js/commit/04c8ee7646d4abcfe13b3fdc3037b75047069ead) to include security fixes, reported by `npm audit`. Fixes #18854 _Only dependencies are updated with security patches, no change in actual code._ _Only dependencies are updated with security patches, no change in actual code._ [GENERAL] [ENHANCEMENT] [react-devtools-core] - Bump to `3.2.2` for a security fix for `ws` [GENERAL] [ENHANCEMENT] [plist] - Bump to `3.0.0` for a security fix for `xmlbuilder` Closes https://github.com/facebook/react-native/pull/19373 Reviewed By: sophiebits Differential Revision: D8149200 Pulled By: hramos fbshipit-source-id: 732fd627b232c315be60ed2da432742e8256a38a Bump Prettier to 1.13.4 on xplat Summary: Bump Prettier to use version 1.13.4 All code changes are caused by running Prettier and should only affect files that have an `format` header. All other changes caused by yarn. Reviewed By: ryanmce Differential Revision: D8251255 fbshipit-source-id: 0b4445c35f1269d72730f2000002a27c1bc35914 Change error message on interpolation (#19571) Summary: Change message in Animated.Interpolation to "inputRange must be monotonically non-decreasing" as it's allowed to give the same x's like in the test [example](https://github.com/facebook/react-native/blob/4435f087713e1d0ac3639e3b3196d71c6402898e/Libraries/Animated/src/__tests__/Interpolation-test.js#L71) Simply giving improper value of interpolation input [GENERAL] [MINOR] [AnimatedInterpolation.js] - Change error message on interpolation improper range error Closes https://github.com/facebook/react-native/pull/19571 Differential Revision: D8310791 Pulled By: TheSavior fbshipit-source-id: 803ef55104ad2a36231c5f18c0c089bd14822bf3 Modified deepFreezeAndThrowOnMutationInDev to use Object.prototype.ha… (#19598) Summary: This PR fixes a bug in `deepFreezeAndThrowOnMutationInDev` which did not take into account that objects passed to it may have been created with `Object.create(null)` and thus may not have a prototype. Such objects don't have the methods `hasOwnProperty`, `__defineGetter__`, or `__defineSetter__` on the instance. I ran into an unrecoverable error in React Native when passing this type of object across the bridge because `deepFreezeAndThrowOnMutationInDev` attempts to call `object.hasOwnProperty(key)`, `object.__defineGetter__` and `object__defineSetter__` on objects passed to it. But my object instance does not have these prototype methods. Changes: * Defined `Object.prototype.hasOwnProperty` as a `const` (pattern used elsewhere in React Native) * Modified calls to `object.hasOwnProperty(key)` to use `hasOwnProperty.call(object, key)` (Per ESLint rule [here](https://eslint.org/docs/rules/no-prototype-builtins)) * Modified calls to deprecated methods `object.__defineGetter__` and `object.__defineSetter__` to instead use `Object.defineProperty` to define get and set methods on the object. (Per guidance on [MDN](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/__defineGetter__)) * Added a new test to `deepFreezeAndThrowOnMutationInDev-test` to verify the fix. I tried to create a reproducible example to post to Snack by passing prototype-less objects to a `Text` component, in various ways, but they appear to be converted to plain objects before crossing the bridge and therefore they do not throw an error. However, I was able to create a new test to reproduce the issue. I added the following test to `deepFreezeAndThrowOnMutationInDev-test`: ```JavaScript it('should not throw on object without prototype', () => { __DEV__ = true; var o = Object.create(null); o.key = 'Value'; expect(() => deepFreezeAndThrowOnMutationInDev(o)).not.toThrow(); }); ``` The changes in this PR include this new test. ESLint test produced no change in Error count (3) or Warnings (671) N/A Other areas with _possibly_ the same issue: https://github.com/facebook/react-native/blob/c6b96c0df789717d53ec520ad28ba0ae00db6ec2/Libraries/vendor/core/mergeInto.js#L50 https://github.com/facebook/react-native/blob/8dc3ba0444c94d9bbb66295b5af885bff9b9cd34/Libraries/ReactNative/requireNativeComponent.js#L134 [GENERAL] [BUGFIX] [Libraries/Utilities/deepFreezeAndThrowOnMutationInDev] -Fix for compatibility with objects without a prototype. Closes https://github.com/facebook/react-native/pull/19598 Differential Revision: D8310845 Pulled By: TheSavior fbshipit-source-id: 020c414a1062a637e97f9ee99bf8e5ba2d1fcf4f Update Danger token (#19606) Summary: Trivial. Closes https://github.com/facebook/react-native/pull/19606 Differential Revision: D8314419 Pulled By: hramos fbshipit-source-id: b298e265c2c87cdc01175b1a014f9003e0673f40 Remove unused include. (#19548) Summary: `LayoutableShadowNode.cpp` includes `"LayoutableShadowNode.h"` as well as `<fabric/core/LayoutContext.h>`. In turn, `LayoutContext.h` then includes `<fabric/core/LayoutableShadowNode.h>`. `LayoutContext.h` doesn't actually require `LayoutableShadowNode.h`, but this unnecessary inclusion can cause duplicate definition errors if the two include paths don't map to exactly the same file. This patch removes the unnecessary include. The CI's build system should cover the testing needed. [INTERNAL] [MINOR] [fabric] - Remove an unnecessary include in fabric/core/layout. Closes https://github.com/facebook/react-native/pull/19548 Differential Revision: D8313337 Pulled By: shergin fbshipit-source-id: 2e01e29ff25131543d9a8601483c2e716c7437be Fix ReactImagePropertyTest SoLoader failures (#19607) Summary: Fixes #18637 & #19309  Check Android `ReactImagePropertyTest` tests pass.   [ANDROID] [BUGFIX] [Unit Tests] - Fix ReactImagePropertyTest SoLoader failure  Closes https://github.com/facebook/react-native/pull/19607 Differential Revision: D8325415 Pulled By: hramos fbshipit-source-id: 598baa3499646bb50da065815c19bb9f76bf6c87 Fixed concurrency issue in remote debugger Reviewed By: rafeca Differential Revision: D8316215 fbshipit-source-id: 70b5000a9bf09897bb9b9d505bfc5dcc7c4c3a41 Fix NullPointerException when emiting event using UIManagerModule Reviewed By: achen1 Differential Revision: D8321766 fbshipit-source-id: ae5052c83f46e08d540b90bf5b71c68f354c566d QuickPerformanceLogger.js: markerPoint + iOS/Android JS binding Reviewed By: alexeylang Differential Revision: D8125546 fbshipit-source-id: bb02921c7d89faba64001bff3b9aaf13f64a7f8b Fabric: Using Size instead of Point as textShadowOffset's type Summary: The current implementation of React Native uses `Size` as the underlying type of `textShadowOffset` which is clearly terribly wrong (especially because negative size values makes no sense). This mistake was borrowed from `NSShadow`, I believe. I don't have time to fix this in every implementation of RN now, so let's use `Size` in Fabric as well. Reviewed By: fkgozali Differential Revision: D8246714 fbshipit-source-id: 1f0bf9b9dfa83802ef3faef2971fed5510494bfd Fabric: Using exact UIFontWeight* constants instead of CGFloat Summary: SUDDENLY, `-[UIFont systemFontOfSize:weight:]` returns incorrect result if `weight` is not exactly equal to any of built-in constants. Reviewed By: fkgozali Differential Revision: D8246712 fbshipit-source-id: 13d59cc8d66a4494437f28d791fd93fa83ebe6fb Fabric: Data model of Touch Events Summary: The data model of Touch events and payload serialization. The implementation mimics W3C standard and current React Native implementation. Reviewed By: fkgozali Differential Revision: D8246711 fbshipit-source-id: 955b2068674f290d8bdb82da1ebfb796dd32971b Fabric: Introducing RCTSurfaceTouchHandler Summary: RCTSurfaceTouchHandler is a complete rewrite of RCTTouchHandler which uses direct Fabric-specific event dispatching pipeline and several new approaches to managing active events (such as high-performant C++ collections, better management of identifier pool, and so on). Besides that, the new implementation is much more W3C compliant that it used to be (see old TODOs near `receiveTouches()` implementation in Javascript). So, touch events work now! Reviewed By: fkgozali Differential Revision: D8246713 fbshipit-source-id: 218dc15cd8f982237de7e2497ff36a7bfe6d37cc Fabric: `convertRawProp` was extended to accept an optional default value Summary: During transforming raw prop (`rawProps[<prop>]`) to typed props (`MyProps.<prop>`) we can face three different cases: * `rawProps` collection has proper serialized value for the key. In this case, we have to set a new value of the typed prop converting value using `fromDynamic`. * `rawProps` collection does not have value for the key. In this case, we have to copy a value from source prop (`sourceValue`). * `rawProps` collection has `null` value for the key. This is the special case which means that the prop was removed from the particular component instance and we have to reset it to some *default* value (which is *not* the same as `sourceValue`). Now the default value of the `defaultValue` (sic!) argument is a default value of the type of the value (which may be different from logical default value). We didn't handle the last case previously and this caused crashes (and unexpected behavior) because `fromDynamic` often cannot handle `null` value. And yes, all this mean that we also have to update all `convertRawProp` call sites where logical default values are not equal to type-specific default values. This is a potential error-prone place, especially because now we have to specify logical default values in two places (in a prop declaration and in a parameterized constructor). And seems there is no way to avoid that without performance loss (because both of those places are basically constructors). My hope is that codegen (where default values are also defined in JavaScript) will help with it eventually. Reviewed By: fkgozali Differential Revision: D8247652 fbshipit-source-id: 2cbe65f5f5cccd7a0d34aaa19e385aacebfe8cb1 Bump eslint-plugin-react in FBSource Reviewed By: yungsters Differential Revision: D8247892 fbshipit-source-id: 4072e65ccf2fdc654f58087a16b4c7709ce393f8 have circle ci use xcode 9.4 (#19629) Summary: Circle CI just released Xcode 9.4 https://discuss.circleci.com/t/xcode-9-4-availability-on-circleci/22648/5 Make sure react native still works with Xcode 9.4. None [IOS][MINOR] Upgrade CI Closes https://github.com/facebook/react-native/pull/19629 Differential Revision: D8343236 Pulled By: hramos fbshipit-source-id: 2266aeafc9a1b1c77ad842f06c9a137bb05b135d Disallow requiring from invariant/warning (#19634) Summary: In this repo we have to require from fbjs/lib/invariant and issues occur when we require directly from invariant/warning. Flow doesn't complain about those requires right now because we have a transitive dependency on invariant and warning causing them to happen to be at the root of node_modules. This change blacklists requiring directly from invariant and warning using Flow. janicduplessis opened a pull request to do this with ESLint back in 2017: https://github.com/facebook/react-native/pull/13014 Closes https://github.com/facebook/react-native/pull/19634 Reviewed By: hramos Differential Revision: D8343060 Pulled By: TheSavior fbshipit-source-id: 9cfc7915b2fb68a567355fc2f5edc4dfcd46f4af Fabric: All *EventHandlers were renamed to *EventEmitter Summary: Using `EventHandlers` name was a bad idea, and I cannot tolerate it anymore. The worst part of it is that when you have a collection of `EventHandlers` objects you cannot use plural word to describe it because `EventHandlers` is an already plural word. And, this object is actually an event emitter, the thing on which we call events. Reviewed By: fkgozali Differential Revision: D8247723 fbshipit-source-id: b3303a4b9529bd6d32bb8ca0378287ebefaedda8 Add MIT License Header Summary: When a third party library is vendored, both the original copyright header as well as React Native's header are required. Reviewed By: fkgozali Differential Revision: D8284116 fbshipit-source-id: 1748eb011c843a87e9ed421597571b66334edfd2 Migrate PickerIOS to ES6 Class Reviewed By: sahrens Differential Revision: D8343380 fbshipit-source-id: 9432f0810c67034f20b44ba9f4955d4ffd2ef1d2 Fix some typos in dumpReactTree.js (#19636) Summary: Simple doc fixes Closes https://github.com/facebook/react-native/pull/19636 Differential Revision: D8344481 Pulled By: TheSavior fbshipit-source-id: b6fa064f70793bdaf1d6346b2775373b74c2ae3b iOS: fix fabric core test Reviewed By: shergin Differential Revision: D8344613 fbshipit-source-id: 10c604e7fbe2ff3b8c47babedea12a197c0c56b2 Switch to Platform.isTV to pass Android Flow Reviewed By: sahrens Differential Revision: D8345911 fbshipit-source-id: 9af7a25127e7c35844a6c59b267a77cf8adba535 Passing forwardedRef to Slider Reviewed By: sahrens Differential Revision: D8345883 fbshipit-source-id: d2affdba14d38593541e591fe72006c76fca166f Enable Flow for bezier Reviewed By: sahrens Differential Revision: D8346102 fbshipit-source-id: bb1a2eccb5472bf6f3fe113303ad96cf3f386cab Don't pass additional args to requireNativeComponent in .android.js files Reviewed By: sahrens Differential Revision: D8345921 fbshipit-source-id: 187048ad4c1b361f0b99b993052bdcaf47a266db Fix iOS e2e tests: bump react-native-babel-preset to ^5 (#19625) Summary: We opt in to version ^5 of the React Native Babel Preset, as required after the bump to Babel 7. This fixes the Objective-C end-to-end test failure in master. (Fixes #19538) See https://github.com/facebook/react-native/commit/34bd776af2f2529009188fced91083203a48fd40#commitcomment-29024085 for prior discussion. There have already been several changes made to the repo during the transition to Babel 7. This PR brings all tests back to green and allows us to move forward with the 0.56 branch cut. We also bump our tests to use Xcode 9.4.0 and iOS 11.4, the latest stable versions of both. Once the 0.56 branch makes it to stable, we can change `react-native-babel-preset@latest` on npm to point to `react-native-babel-preset@5.0.1` (or newer), and undo the change made to `init.js` we made as part of this diff. Wait for Circle CI to run: https://circleci.com/workflow-run/e39a66d7-bf8a-4b31-a22f-eef30a2c53bc [GENERAL] [BREAKING] [Babel] - Bump React Native Babel Preset version used by RN CLI to Babel v7 compliant release Closes https://github.com/facebook/react-native/pull/19625 Reviewed By: TheSavior Differential Revision: D8343861 Pulled By: hramos fbshipit-source-id: 42644d5b0bfb40a8bc592ae3461c5008deef8232 Upgrade to Flow v0.74.0 Reviewed By: panagosg7 Differential Revision: D8322344 fbshipit-source-id: 1208528009785f7f797201777287af525d0a9ca1 Open source Flow definition for Jest Reviewed By: sahrens Differential Revision: D8347198 fbshipit-source-id: 0b6194bfd14bad09db7dcd462f0bf342c9c6fe44 Add back deprecated getParent methods for non-breaking API change (#775) Summary: I'm not totally sure what I'm doing so if this needs changes let me know. Closes https://github.com/facebook/yoga/pull/775 Reviewed By: emilsjolander Differential Revision: D8331892 Pulled By: passy fbshipit-source-id: eb1023e666322d2472e4081fd4a4e72a7b43d049 Trigger onFocus/onBlur instead of onPressIn/onPressOut (eventually, but for now just deprecate) (#18470) Summary: Currently on iOS and Android focus/blur events trigger onPressIn/onPressOut. Based on discussions with people are several companies who use react-native we're proposing instead triggering new events onFocus/onBlur. Initial discussion on Slack with some from the core team on Slack seemed positive. Couple reasons: * The current API behavior overloads onPressIn/onPressOut. That means on platforms like react-native-web, if focus/blur support was added (as we're hoping for), even though onPressIn/onPressOut would be useful as the name describes, you wouldn't be able to distinguish between it and browser element focus/blur events. * The names aren't as self-documenting/intuitive as onFocus/onBlur, especially for react-dom users. There aren't any current tests around this, but I intend to add them if we solidify the API. There's also an option question on the transition--do we deprecate the existing API with a warning? This PR just deprecates them, though it will on any TV platform when something becomes focused regardless of whether they use the API or not. This isn't ideal. It's not clear if there are alternatives or if just right away breaking the API for TV users is the correct solution, if we can get consensus between the few parties who are using it. *** I'm interested to hear counter points or prior discussions. Cc/ matthargett dlowder-salesforce rozele Closes https://github.com/facebook/react-native/pull/18470 Differential Revision: D8368109 Pulled By: hramos fbshipit-source-id: 22587b82e091645e748b6c2d721fdff06d54837f Jest: Upgrade Flow Definition in RN + Metro Reviewed By: sahrens Differential Revision: D8371076 fbshipit-source-id: 12d03c545ca190a5fda1ff319e5ea906173d2241 RN: A wild YellowBox has appeared! Summary: Replaces the existing `YellowBox` with a modern one. Here are the notable changes: - Sort warnings by recency (with most recent on top). - Group warnings by format string if present. - Present stack traces similar to RedBox. - Show status of loading source maps. - Support inspecting each occurrence of a warning. - Fixed a bunch of edge cases and race conditions. Reviewed By: TheSavior Differential Revision: D8345180 fbshipit-source-id: b9e10d526b262c3985bbea639ba2ea0e7cad5081 fix forwardRef displayName on Text and View Reviewed By: TheSavior Differential Revision: D8342852 fbshipit-source-id: 5af80edfd5de5b6d6ea6fdc24abf8931f767c812 Fix more forwardRef displayNames Reviewed By: TheSavior Differential Revision: D8342904 fbshipit-source-id: b6e53da7305d71635528a42e80910f4a9db0455c Upgrade react-test-render to handle React.forwardRef Reviewed By: TheSavior Differential Revision: D8346704 fbshipit-source-id: fc6686fab12a429780fb16e4129e8987529b13af iOS: Fixed some props conversion errors Summary: * numbers in JS are doubles in native land, since there's no notion of int or int64 in JS - so simply convert numbers to int instead of assuming it's int * the parsing of Yoga props with `'...%'` string value has a bug: it should be copying the number instead of the `%` Reviewed By: shergin Differential Revision: D8370873 fbshipit-source-id: 44e9e3f0530c000c963e8e9ca66e8b0a48d80bcd Flow: textShadownOffest needs to be stricter Summary: `width` and `height` are required for this style prop, for the sake of consistency (and Fabric). Callsites should set one of them to 0 instead of not specifying it. Reviewed By: TheSavior, shergin Differential Revision: D8371064 fbshipit-source-id: b0ffd6b6543ac5456a3708382966e7b3df241f7e Revert D8346704: Upgrade react-test-render to handle React.forwardRef Differential Revision: D8346704 Original commit changeset: fc6686fab12a fbshipit-source-id: 4d1a9d109ef5be93c40df2701f35966bf441eb0a Revert D8342904: [StrictMode] Fix more forwardRef displayNames Differential Revision: D8342904 Original commit changeset: b6e53da7305d fbshipit-source-id: abf5fa6ccb16058f20cbb569ecfc790fad017133 fix No bundle url present in iOS (#19643) Summary: fix No bundle url present in iOS. Related issue: https://github.com/facebook/react-native/issues/14118, https://github.com/facebook/react-native/issues/12754. Pass all current ci none [GENERAL] [BUGFIX] [iOS] - fix No bundle url present in iOS Closes https://github.com/facebook/react-native/pull/19643 Differential Revision: D8374583 Pulled By: hramos fbshipit-source-id: 62d621f431d2067825dc701f87044ecb1d720f14 Fixed comparison on possible null object (#19675) Summary: Motivation: getting NPE on BlobModule part <img width="1718" alt="screen shot 2018-06-12 at 3 03 48 pm" src="https://user-images.githubusercontent.com/4340636/41292212-31e0acc8-6e52-11e8-916a-dd6fc2bb695a.png"> Should still build and pass all tests since project settings changes should be safe changes.  No documentation change is required   [ANDROID][BUGFIX][BlobModule] safe equals checks  Closes https://github.com/facebook/react-native/pull/19675 Differential Revision: D8380228 Pulled By: hramos fbshipit-source-id: 1d3caefdb7a7d638228490ef7b3771617745d26f Implement console group APIs (#18555) Summary: Thank you for sending the PR! We appreciate you spending the time to work on these changes. Help us understand your motivation by explaining why you decided to make this change. React Native provides an implementation of the Web "Console" API, which is a powerful mechanism for debugging and analyzing RN apps. However, one subset of the Console API that RN does not provide is the "grouping" functions, namely `console.group` and `console.groupEnd`. These functions provide a useful way to see how an application behaves within a different parts of an application hierarchy. I modified the "RNTester" app to create a console group each time an example is tapped, and the group is ended when the "Back" button is tapped. Here is an example of the grouping as seen in the Xcode console. <img width="651" alt="console grouping" src="https://user-images.githubusercontent.com/445421/37882070-d2ae7860-306d-11e8-8cf4-be843a864f43.png"> https://github.com/facebook/react-native-website/pull/270 [GENERAL] [ENHANCEMENT] [console.js] - Add `console.group()` and `console.groupEnd()` APIs, matching the Web Console API. Closes https://github.com/facebook/react-native/pull/18555 Differential Revision: D7992131 Pulled By: hramos fbshipit-source-id: 0d28896292563922240ae2100ed49e35b6d1f102 Bump soloader to 0.5.0 (#19676) Summary: Closes https://github.com/facebook/react-native/pull/19676 0.5.0 adds compatibility for Android P. Reviewed By: mdvacca Differential Revision: D8379610 fbshipit-source-id: cbef6c2e5e82e2d9e17756b00d210fecb04e8a40 Expose getResolverMainFields() config param Reviewed By: mjesun Differential Revision: D8380198 fbshipit-source-id: 3d5b7a5873095db2b90a23b5054fb94579df3f1a Bump metro@0.39.0 Reviewed By: mjesun, davidaurelio Differential Revision: D8380199 fbshipit-source-id: 6b9e3aa343e8d0526a3c42d5ea266c44428d31f8 YellowBox: Apply SafeAreaView in Header Summary: Uses `SafeAreaView` in the YellowBox inspector header so that it does not collide with the status bar. Reviewed By: sahrens Differential Revision: D8374861 fbshipit-source-id: e67358ac9268db8291cacf79df402f3bd5a2173d use android build-tools 26.0.2 and set compileSdk to 26 (#19662) Summary: Android Target API Level 26 will be required starting from August 2018, it's so soon 😄.Read https://android-developers.googleblog.com/2017/12/improving-app-security-and-performance.html This PR uses android build tools 26.0.2, support library 26.1.0 (with android lifecycle) and setting compileSdkVersion to 26, but leaving minSdkVersion and targetSdkVersion intact, which will make targeting 26 easy. Circle CI: https://circleci.com/gh/dulmandakh/react-native/209 Everything will build and work just fine. [ANDROID] [ENHANCEMENT] [TOOLS] - Use android build-tools 26.0.2 and set compileSdk to 26, and use support library version 26.1.0. Closes https://github.com/facebook/react-native/pull/19662 Differential Revision: D8398855 Pulled By: hramos fbshipit-source-id: a4066eb04cb5f947efe1f3202b638c1092b79aae Support animated values for border dimensions Summary: The flow types for these were too restrictive. Fixes https://github.com/facebook/react-native/issues/19093 Reviewed By: yungsters Differential Revision: D8409550 fbshipit-source-id: e4774e8856efc998ff1fa6cdcbe7b0cb6db2c4e3 YellowBox: Define in __DEV__ Only Summary: This makes it so that `YellowBox` and its dependencies are completely stripped from production bundles. Reviewed By: sahrens Differential Revision: D8402545 fbshipit-source-id: 6993521280a02dfe5eab8863d12c46781f35444f - Keyboard layout now updates when changing keyboardType while it has focus (#19027) Summary: This PR makes sure that changing the `keyboardType` props of `<TextInput>` is reflected while the text field has focus. It is something that is also discusses in #13782. The workaround mentioned in that issue using `key` causes the TextInput to re-render itself which has some undesired side-effects. Fixes #13782 ```javascript export default class KeyboardTypeApp extends Component { state = { keyboardType: 'default' }; toggleKeyboardType = () => { this.setState({ keyboardType: this.state.keyboardType === 'default' ? 'numeric' : 'default' }); } render() { return ( <View style={{ padding: 40 }}> <TextInput autoFocus value="Press Toggle :)" keyboardType={this.state.keyboardType} /> <Button title="Toggle" onPress={this.toggleKeyboardType} /> </View> ); } } ``` ![video](https://user-images.githubusercontent.com/706368/39268429-3e331440-48d0-11e8-947c-7d334e3cec50.gif)  [IOS] [ENHANCEMENT] [TextInput] - Keyboard layout now updates when changing `keyboardType` while it has focus  Closes https://github.com/facebook/react-native/pull/19027 Differential Revision: D8416007 Pulled By: PeteTheHeat fbshipit-source-id: c4f89ab3dc0819bca52feddbc9c7a9f62fd96794 Bumping Metro to 0.39.1 Reviewed By: rafeca Differential Revision: D8418105 fbshipit-source-id: 66032deb53f46a388b81233e8d00d7af6a2c7fa7 improve NativeModuleRegistryBuilder.java (#16402) Summary: I met the error `Native module xyz tried to override xyz for module name xyzModuleName. If this was your intention...` after something went wrong during `react-native link` - one module somehow ended up being included twice in the `getPackages` method, as in: ```java Override protected List<ReactPackage> getPackages() { return Arrays.<ReactPackage>asList( new MainReactPackage(), new WowPackage(), new WowPackage(), ``` Since I have > 20 native modules it took me a little while to find out what the problem was. The improved error message should make the problem clearer to anybody who may encounter it. I did try to refactor the code a little more, by extracting the whole part of: ```java String name = moduleHolder.getName(); if (namesToType.containsKey(name)) { Class<? extends NativeModule> existingNativeModule = namesToType.get(name); if (!moduleHolder.getCanOverrideExistingModule()) { throw new IllegalStateException(getModuleOverridingExceptionMessage( type.getSimpleName(), existingNativeModule.getSimpleName(), name )); } mModules.remove(existingNativeModule); } namesToType.put(name, type); mModules.put(type, moduleHolder); ``` out into a separate method since there were two places where nearly identical code was written. I have built RN from source and used it in a very simple app with RN vector icons (the package creates a native module as can be seen [here](https://github.com/oblador/react-native-vector-icons/blob/master/android/src/main/java/com/oblador/vectoricons/VectorIconsPackage.java#L19)). After including the module twice, ie. ```java Override protected List<ReactPackage> getPackages() { return Arrays.<ReactPackage>asList( new MainReactPackage(), new VectorIconsPackage(), new VectorIconsPackage() ); } ``` I get the improved error description, as seen in the screenshot. <img src="https://user-images.githubusercontent.com/1566403/36340960-3289d9d0-13e7-11e8-8d17-e1651da17841.png" height="500"> [ANDROID] [MINOR] [NativeModuleRegistryBuilder] - Improve error message and refactor putting native modules to module maps Closes https://github.com/facebook/react-native/pull/16402 Differential Revision: D8421392 Pulled By: hramos fbshipit-source-id: 719bd37b4681933d35858621b402ae73dd460a5b YellowBox: Restore ES5 Compatibility Reviewed By: sahrens Differential Revision: D8421561 fbshipit-source-id: c2b8d430f4d0c9ce0d5177f0af5eb5f404916024 Publish releases automatically, update docs (#19715) Summary: Now that tests are green, we can return to automatic publishing to npm based on git tags. As long as all tests are passing, deploying a new release of React Native is as easy as tagging a commit. I've updated `Releases.md` to reflect today's release process. Future Work: Include information about updating the website, as this is no longer done automatically. Closes https://github.com/facebook/react-native/pull/19715 Differential Revision: D8429834 Pulled By: hramos fbshipit-source-id: 2c6f2c80ac43c4e6d20c01e06ba14a7e4b16180d Feature/add decimal pad to android (#19714) Summary: For a current use-case we need the a keyboard with characters 0-9 and a decimal point (or comma depending on language settings) This exists on iOS as UIKeyboardType "decimalPad" and this is what react-native maps to for both "numeric" and "decimal-pad". This also exists on Android as inputType "numberDecimal", but is currently not accessible through react-native. This PR maps the value "decimal-pad" of the keyboardType property of TextInput to the Android inputType "numberDecimal", effectively making "decimal-pad" cross platform without breaking anything. * https://facebook.github.io/react-native/docs/textinput.html#keyboardtype * https://developer.apple.com/documentation/uikit/uikeyboardtype * https://developer.android.com/reference/android/widget/TextView#attr_android:inputType There is this bug in some Samsung keyboards where both the - sign and decimal sign disappear when the keyboardType is set to "number" and both the "signed" and "decimal" flags are set. (Like is the case when using the react-native keyboardType prop "numeric".) https://androidforums.com/threads/numeric-soft-keyboard-missing-minus-sign-in-android-8-0-samsung-a5.1272628/ For developers that need decimal numbers but not negative ones, using "decimal-pad" will provide a workaround. I reproduced this on a Samsung A5 only, but maybe other phones have this exact issue. https://github.com/facebook/react-native/issues/12988 https://github.com/facebook/react-native/issues/12977 https://github.com/facebook/react-native/issues/17473 https://github.com/facebook/react-native/issues/17474 * Added testcase consistent with existing keyboardType tests * Also added testcase for the related, but missing number-pad This PR follows the same approach as the recently merged PR introducing "number-pad" https://github.com/facebook/react-native/pull/18350/commits/b638847a46491bd75e7ce7928c73f7cb78399195 Documentation PR: https://github.com/facebook/react-native-website/pull/405 [ANDROID] [ENHANCEMENT] [TextInput] - Added "decimal-pad" keyboard type Closes https://github.com/facebook/react-native/pull/19714 Differential Revision: D8429185 Pulled By: mdvacca fbshipit-source-id: 6b56da2088f2be427ebffa04c4e17c91ffb9f7d9 add google maven repo in android project template (#19712) Summary: This PR will add Google maven repo to RN project template that contains com.android.support:appcompat-v7:26.1.0, thus fixes `react-native run-android` using version 0.56.0-rc.1 CI is Green - https://circleci.com/gh/dulmandakh/react-native/235 new Android projects will build and run just fine. Closes https://github.com/facebook/react-native/pull/19712 Differential Revision: D8433730 Pulled By: hramos fbshipit-source-id: b7d5a1cd5a97b1c4aad2a307158d6dbfcf9a42a5 bump gradle-plugin@2.3.3, gradle@3.5.1, gradle-download-task@3.4.3 (#19697) Summary: bump gradle-plugin@2.3.3, gradle@3.5.1, gradle-download-task@3.4.3, as we landed build tools 26.0.2 with https://github.com/facebook/react-native/commit/065c5b6590de18281a8c592a04240751c655c03c Will improve Android build performance. Everything will work as normal, but build faster.  [ANDROID] [ENHANCEMENT] [TOOLS] - bump gradle-plugin@2.3.3, gradle@3.5.1, gradle-download-task@3.4.3 Closes https://github.com/facebook/react-native/pull/19697 Differential Revision: D8433743 Pulled By: hramos fbshipit-source-id: da72aeb314bed7f63807a0c69bebd24c633cc807 Update GitHub Issue templates (#19723) Summary: Now that we have templates for everything we want to handle in the repo, the bot will go back to automatically closing issues that do not use one of the provided templates. We have an escape valve for generic issues ("For Discussion"), so anyone who gets their issue closed automatically by the bot is unlikely to have read our instructions. Closes https://github.com/facebook/react-native/pull/19723 Differential Revision: D8435415 Pulled By: hramos fbshipit-source-id: 41db33cefce1367ad8f3d9440b7bba27565679cb add RNTester to ci (#19673) Summary: * Current ci is missing an important part to test the whole part. With this we can make sure the js and android part compiles. * Ensure the current android proguard rules is okay. The `my-release-key.keystore` is just a copy of debug.keystore in `react-native/keystores`. Pass all ci. none [GENERAL] [ENHANCEMENT] [CI] - Add RNTester to ci Closes https://github.com/facebook/react-native/pull/19673 Differential Revision: D8435419 Pulled By: hramos fbshipit-source-id: d3d92a5d1b8477c1f298643cc96695769e5c93ea iOS: Fixed the bug where a Backspace event was emitted when entering characters after clearing a text in TextInput by an empty string (#18627) Summary: The bug #18374 was caused by the loose condition to execute `stringByReplacingCharactersInRange` in the method `textInputShouldChangeTextInRange` . As a result, `findMismatch` wrongly returning `true` which ends up the Backspace event being fired in another `textInputShouldChangeTextInRange` call in `textInputDidChange`.  1. Pass all the tests by `yarn run test` 2. Run the following code and type any text. (This code is brought from #18374. Thank you michalpetrov!!) And then verify that 'Backspace' events are not emitted after clearing text and entering any letters. ```javascript type Props = {}; type State = { text: string, keys: string }; export default class App extends Component<Props, State> { state = {text: '', keys: ''} render() { return ( <View style={styles.container}> <TextInput style={styles.textInput} value={this.state.text} onChangeText={this.onChangeText} onKeyPress={this.onKeyPress}/> <Button title="Clear" onPress={this.onClear}/> <Text>Text: {this.state.text}</Text> <Text>Keys: {this.state.keys}</Text> </View> ); } onChangeText = (text: string) => { this.setState({text}) } onKeyPress = ({ nativeEvent }: Object) => { this.setState({keys: this.state.keys + nativeEvent.key + ', '}) } onClear = () => { this.setState({text: '', keys: ''}) } } ```   [IOS] [BUGFIX] [TextInput] - Fixed the bug where Backspace event was emitted when entering a character after clearing a text in TextInput by an empty string  Closes https://github.com/facebook/react-native/pull/18627 Differential Revision: D8436331 Pulled By: hramos fbshipit-source-id: ec75a6ca926061cbf7cb106db652f2b4a71c9a0c Refactor Log to Flog in Fabric Reviewed By: shergin Differential Revision: D8363593 fbshipit-source-id: fb4104b66ef3d50d4101c39a1bf4515e6d0ecd19 Adding UIManager performance counters in Fabric Reviewed By: fkgozali Differential Revision: D8381255 fbshipit-source-id: d817557c8a3033d0d7ae47e5ea0a21d224279e29 Add systrace logging for Fabric android Reviewed By: fkgozali Differential Revision: D8387339 fbshipit-source-id: 2e202566541cc25fb6b8773a94e607e8b40fb0ce Tightening some Image Flow Types Reviewed By: yungsters Differential Revision: D7270059 fbshipit-source-id: 3b9727363aeb6910fbbdc613a70d9e8cac97b3b1 ios: expose surfaceForRootTag: up the chain Summary: The app needs to find the surface by rootTag at some point. Reviewed By: shergin Differential Revision: D8391957 fbshipit-source-id: b0bb107b7be882071890afb46de17b50e7ee060d Keep UIManagerModule as a default renderer Reviewed By: fkgozali Differential Revision: D8439626 fbshipit-source-id: d761d977c9e6dab38f21e18da72b045483431f79 Checkbox to inherit from AppCompatCheckBox (#18318) Summary: The checkbox components inherits from `android.widget.CheckBox`. `AppCompatCheckBox` offers better appearance and support for advanced features (eg. tinting) on older APIs. ~~However, the build fails for some reason; If somebody could shed some light on this, I'd appreciate it.~~ Thanks for the comment, I was being blind and somehow ignored the BUCK file. I have created a simple app with a checkbox. Screenshot from android 4.1 (current master): <img src="https://user-images.githubusercontent.com/1566403/37357997-2d34bdb8-26ea-11e8-8c77-709a4f96c6bf.png" width="300" /> Screenshot after applying the change, also android 4.1: <img src="https://user-images.githubusercontent.com/1566403/37358016-3c28fb86-26ea-11e8-8dca-3a92e41450c9.png" width="300" /> https://github.com/facebook/react-native/pull/18300 (this PR is needed to support tinting on older android api levels) [ANDROID] [ENHANCEMENT] [Checkbox] - Checkbox inherits from AppCompatCheckBox Closes https://github.com/facebook/react-native/pull/18318 Differential Revision: D7268393 Pulled By: hramos fbshipit-source-id: 01cb2819f4d56c4e0f94cdd1fb5e1a90667a398a Bump Metro dep in RN preset to 39.1, preset to 5.0.2 Reviewed By: rubennorte Differential Revision: D8445528 fbshipit-source-id: e8937509bb1384a2d62e880c860306d8c86dab92 Revert "Bump soloader to 0.5.0 (#19676)" (#19739) Summary: This reverts commit e3c5524bc65026a4c3d062cb05cee85b6d835286. Closes https://github.com/facebook/react-native/pull/19739 Differential Revision: D8446714 Pulled By: hramos fbshipit-source-id: 1b0e78fe57e9864faafcc766364bd76a1ba5bd03 Bugfix/ci lint proguard (#19724) Summary: * avoid lint to interrupt ci * add proguard rules pass all ci none [GENERAL] [ENHANCEMENT] [CI] - Fix lint and proguard Closes https://github.com/facebook/react-native/pull/19724 Differential Revision: D8446721 Pulled By: hramos fbshipit-source-id: b21c5418210b27dda6a7194995a25df39af0c92a fix permission requests on pre-M android (#19734) Summary: On pre-M devices, `PermissionsAndroid.request` currently returns a boolean, whereas on newer, it returns GRANTED, DENIED or other constants defined in `PermissionsModule.java` given the example form the [docs](https://facebook.github.io/react-native/docs/permissionsandroid.html) which I guess many people use, this will lead to code that does not work before M (it will tell you that permissions are not given even if they are in the manifest). I believe the author of [this](https://github.com/facebook/react-native/commit/51efaab1209a41254c90dcba596d49e3cbc2d925) forgot to change the resolved value in this one place but changed it in other places, eg [here](https://github.com/facebook/react-native/commit/51efaab1209a41254c90dcba596d49e3cbc2d925#diff-2a74096453bc8faa5d4a1599ad0ab33fL99). The docs are written correctly: > On devices before SDK version 23, the permissions are automatically granted if they appear in the manifest, so check and request should always be true. but the code is not right because we'd need to check for `if (granted === PermissionsAndroid.RESULTS.GRANTED || granted === true) {` Also, the behavior is done correctly in [requestMultiplePermissions](https://github.com/facebook/react-native/blob/26684cf3adf4094eb6c405d345a75bf8c7c0bf88/ReactAndroid/src/main/java/com/facebook/react/modules/permissions/PermissionsModule.java#L148) so returning a boolean is an inconsistency. I tested this locally. The code is the same as on line [148](https://github.com/facebook/react-native/blob/26684cf3adf4094eb6c405d345a75bf8c7c0bf88/ReactAndroid/src/main/java/com/facebook/react/modules/permissions/PermissionsModule.java#L148) where it is done correctly. [ANDROID] [BUGFIX] [PermissionAndroid] - return GRANTED / DENIED instead of true / false on pre-M android <!-- **INTERNAL and MINOR tagged notes will not be included in the next version's final release notes.** CATEGORY [----------] TYPE [ CLI …

react-native-bot added the Help Wanted Issues ideal for external contributors. label May 11, 2018

dhei mentioned this issue May 16, 2018

Upgrade npm dependencies to resolve security warnings from npm audit microsoft/appcenter-sdk-react-native#308

Merged

byCedric mentioned this issue May 21, 2018

Fix/security issues #19373

Closed

facebook-github-bot closed this as completed in 3a1d949 Jun 6, 2018

kelset mentioned this issue Mar 12, 2019

Dependency ws1.1.5 has security issue, should be upgraded #23845

Closed

facebook locked as resolved and limited conversation to collaborators Jun 6, 2019

react-native-bot added the Resolution: Locked This issue was locked by the bot. label Jun 6, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

High/medium nsp vulnerabilities for dependency ws and hoek #18854

High/medium nsp vulnerabilities for dependency ws and hoek #18854

CapitanRedBeard commented Apr 13, 2018

CapitanRedBeard commented Apr 13, 2018

Summys commented Apr 14, 2018

athalay commented May 7, 2018

Rohithzr commented May 8, 2018

CapitanRedBeard commented May 8, 2018

xlcrr commented May 9, 2018 •

edited

Loading

Rohithzr commented May 10, 2018

byCedric commented May 19, 2018

byCedric commented May 21, 2018

Oraclesports commented May 30, 2018

byCedric commented May 30, 2018

tetreault commented May 31, 2018

byCedric commented May 31, 2018 •

edited

Loading

tetreault commented May 31, 2018

Shazam14 commented Sep 29, 2018

High/medium nsp vulnerabilities for dependency ws and hoek #18854

High/medium nsp vulnerabilities for dependency ws and hoek #18854

Comments

CapitanRedBeard commented Apr 13, 2018

Environment

Steps to Reproduce

Expected Behavior

Actual Behavior

CapitanRedBeard commented Apr 13, 2018

Summys commented Apr 14, 2018

athalay commented May 7, 2018

Rohithzr commented May 8, 2018

CapitanRedBeard commented May 8, 2018

xlcrr commented May 9, 2018 • edited Loading

Rohithzr commented May 10, 2018

byCedric commented May 19, 2018

byCedric commented May 21, 2018

Oraclesports commented May 30, 2018

byCedric commented May 30, 2018

tetreault commented May 31, 2018

byCedric commented May 31, 2018 • edited Loading

tetreault commented May 31, 2018

Shazam14 commented Sep 29, 2018

xlcrr commented May 9, 2018 •

edited

Loading

byCedric commented May 31, 2018 •

edited

Loading