Skip to content

Address all known vulnerabilities (4.0.0) #118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aarsilv merged 3 commits into from
May 26, 2026
Merged

Address all known vulnerabilities (4.0.0) #118

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2db2650
Address all known vulnerabilities (4.0.0) [FFESUPPORT-728]
aarsilv May 25, 2026
34f494f
ci: bump node-version in setup composite action to 20.x
aarsilv May 25, 2026
73c09b9
Address Copilot review: re-enable no-var, switch lone var to const
aarsilv May 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/actions/setup/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ runs:
- name: Setup Node.js
uses: actions/setup-node@v3
with:
node-version: '18.x' # Specify the Node.js version directly here
node-version: '20.x' # Specify the Node.js version directly here

@aarsilv aarsilv May 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 context from AI: Composite action was overriding the job-level Node 20 back to 18, breaking the engines.node check — caught in the first CI run.


- name: Cache dependencies
id: yarn-cache
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v3
with:
node-version: '18'
node-version: '20'

- name: Setup
uses: ./.github/actions/setup
Comment on lines 40 to 44

@aarsilv aarsilv May 25, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 response from AI: Good catch — already fixed in commit 34f494f. The composite action .github/actions/setup/action.yml had a hard-coded node-version: '20.x' after the bump (was '18.x'). CI is now green on the latest commit: build, lint, and test all pass.

Expand Down Expand Up @@ -68,7 +68,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v3
with:
node-version: '18'
node-version: '20'

- name: Setup
uses: ./.github/actions/setup
Comment on lines 70 to 74

@aarsilv aarsilv May 25, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 response from AI: Good catch — already fixed in commit 34f494f. The composite action .github/actions/setup/action.yml had a hard-coded node-version: '20.x' after the bump (was '18.x'). CI is now green on the latest commit: build, lint, and test all pass.

Expand All @@ -91,7 +91,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v3
with:
node-version: '18'
node-version: '20'

- name: Setup
uses: ./.github/actions/setup
Comment on lines 93 to 97

@aarsilv aarsilv May 25, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 response from AI: Good catch — already fixed in commit 34f494f. The composite action .github/actions/setup/action.yml had a hard-coded node-version: '20.x' after the bump (was '18.x'). CI is now green on the latest commit: build, lint, and test all pass.

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/publish.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:

- uses: actions/setup-node@v3
with:
node-version: '18.x'
node-version: '20.x'
- run: yarn install
- run: yarn test
- run: yarn prepack
Expand Down
2 changes: 1 addition & 1 deletion .nvmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
16.20.2
20
2 changes: 1 addition & 1 deletion babel.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
module.exports = {
presets: ['module:metro-react-native-babel-preset'],
presets: ['module:@react-native/babel-preset'],
};
14 changes: 9 additions & 5 deletions example/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
"@react-navigation/bottom-tabs": "^7.4.0",
"@react-navigation/elements": "^2.6.3",
"@react-navigation/native": "^7.1.8",
"expo": "~54.0.31",
"expo": "~54.0.34",
"expo-constants": "~18.0.13",
"expo-font": "~14.0.10",
"expo-haptics": "~15.0.8",
Expand All @@ -31,17 +31,21 @@
"react-dom": "19.1.0",
"react-native": "0.81.5",
"react-native-gesture-handler": "~2.28.0",
"react-native-worklets": "0.5.1",
"react-native-reanimated": "~4.1.1",
"react-native-safe-area-context": "~5.6.0",
"react-native-screens": "~4.16.0",
"react-native-web": "~0.21.0"
"react-native-web": "~0.21.0",
"react-native-worklets": "0.5.1"
},
"devDependencies": {
"@types/react": "~19.1.0",
"typescript": "~5.9.2",
"eslint": "^9.25.0",
"eslint-config-expo": "~10.0.0"
"eslint-config-expo": "~10.0.0",
"typescript": "~5.9.2"
},
"resolutions": {

@aarsilv aarsilv May 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 context from AI: Two targeted resolutions clear the last vulns (postcss, uuid) reachable only via expo SDK 54 transitives. example/ is private, so they do not propagate to SDK consumers.

"postcss": "^8.5.10",
"uuid": "^11.1.1"
},
"private": true
}
2,755 changes: 1,501 additions & 1,254 deletions example/yarn.lock
View file
Open in desktop

Large diffs are not rendered by default.

75 changes: 44 additions & 31 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@eppo/react-native-sdk",
"version": "3.8.0",
"version": "4.0.0",

@aarsilv aarsilv May 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 context from AI: SemVer-major because engines.node tightens to >=20. The bulk of this diff is dropping unused devDeps (express, @types/express, del-cli, pod-install, @types/react-native) and replacing the @react-native-community/eslint-config stack with a minimal @typescript-eslint + prettier setup — both of which were the main sources of audit findings.

"description": "Eppo React Native SDK",
"main": "lib/commonjs/index",
"module": "lib/module/index",
Expand Down Expand Up @@ -51,45 +51,40 @@
"registry": "https://registry.npmjs.org/"
},
"dependencies": {
"@eppo/js-client-sdk-common": "4.15.1",
"@react-native-async-storage/async-storage": "^1.18.0",
"@eppo/js-client-sdk-common": "5.0.0",
"@react-native-async-storage/async-storage": "^2.2.0",
"spark-md5": "^3.0.2"
},
"devDependencies": {
"@evilmartians/lefthook": "^1.2.2",
"@react-native-community/eslint-config": "^3.0.2",
"@types/express": "^4.17.13",
"@types/jest": "^28.1.2",
"@types/react": "~17.0.21",
"@types/react-native": "0.70.0",
"@evilmartians/lefthook": "^1.13.6",
"@types/jest": "^30.0.0",
"@types/react": "^19.2.0",
"@types/spark-md5": "^3.0.5",
"del-cli": "^5.0.0",
"eslint": "^8.4.1",
"eslint-config-prettier": "^8.5.0",
"eslint-plugin-prettier": "^4.0.0",
"express": "^4.18.0",
"jest": "^29.7.0",
"pod-install": "^0.1.0",
"prettier": "^2.0.5",
"react": "18.2.0",
"react-native": "0.71.3",
"react-native-builder-bob": "^0.20.0",
"testdouble": "^3.16.4",
"typescript": "^4.5.2"
},
"resolutions": {
"@types/react": "17.0.21",
"micromatch": "4.0.8"
"@typescript-eslint/eslint-plugin": "^8.59.1",
"@typescript-eslint/parser": "^8.59.1",
"@babel/core": "^7.29.0",
"@react-native/babel-preset": "0.85.3",
"@react-native/jest-preset": "0.85.3",
"eslint": "^8.57.1",
"eslint-config-prettier": "^10.1.8",
"eslint-plugin-prettier": "^5.5.5",
"jest": "^30.4.0",
"prettier": "^3.8.0",
"react": "19.2.3",
"react-native": "0.85.3",
"react-native-builder-bob": "^0.41.0",
"testdouble": "^3.20.0",
"typescript": "^5.9.2"
},
"peerDependencies": {
"react": "*",
"react-native": "*"
},
"engines": {
"node": ">= 18.0.0"
"node": ">= 20.0.0"
},
"jest": {
"preset": "react-native",
"preset": "@react-native/jest-preset",
"testMatch": [
"<rootDir>/src/__tests__/**/*.(spec|test).[jt]s?(x)"
],
Expand All @@ -103,8 +98,14 @@
},
"eslintConfig": {
"root": true,
"parser": "@typescript-eslint/parser",
"plugins": [
"@typescript-eslint",
"prettier"
],
"extends": [
"@react-native-community",
"eslint:recommended",
"plugin:@typescript-eslint/recommended",
"prettier"
],
"rules": {
Expand All @@ -117,15 +118,27 @@
"trailingComma": "es5",
"useTabs": false
}
],
"@typescript-eslint/no-require-imports": "off",
"@typescript-eslint/no-explicit-any": "off",
"@typescript-eslint/no-unused-vars": [
"error",
{
"argsIgnorePattern": "^_",
"varsIgnorePattern": "^_"
}
]
},
"env": {
"jest": true
"jest": true,
"node": true,
"es2022": true
}
},
"eslintIgnore": [
"node_modules/",
"lib/"
"lib/",
"example/"
],
"prettier": {
"quoteProps": "consistent",
Expand Down
6 changes: 3 additions & 3 deletions src/__tests__/index.test.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
import * as td from 'testdouble';

import type { EppoAsyncStorage } from 'src/async-storage';
import {
VariationType,
import { VariationType } from '@eppo/js-client-sdk-common';

@aarsilv aarsilv May 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 context from AI: Same verbatimModuleSyntax split as in src/index.tsx.

import type {
Flag,
IAssignmentLogger,
type IAssignmentEvent,
IAssignmentEvent,
IPrecomputedConfigurationResponse,
} from '@eppo/js-client-sdk-common';
import {
Expand Down
8 changes: 4 additions & 4 deletions src/async-storage.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ class AsyncStorageStore<T> implements ISyncStore<T> {
}

public setEntries(entries: Record<string, T>): void {
for (var key in entries) {
for (const key in entries) {

@aarsilv aarsilv May 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 context from AI: Sole var in src/; switched to const per Copilot second-pass review (rule re-enabled in package.json).

this.cache[key] = entries[key];
}

Expand All @@ -49,9 +49,9 @@ class AsyncStorageStore<T> implements ISyncStore<T> {
}
}

export class EppoAsyncStorage
implements IConfigurationStore<Flag | ObfuscatedFlag>
{
export class EppoAsyncStorage implements IConfigurationStore<
Flag | ObfuscatedFlag
> {
servingStore: ISyncStore<Flag | ObfuscatedFlag>;
persistentStore: IAsyncStore<Flag | ObfuscatedFlag> | null;
private initialized: boolean;
Expand Down
8 changes: 4 additions & 4 deletions src/cache/async-storage-assignment-shim.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,19 +45,19 @@ export class AsyncStorageAssignmentShim implements Map<string, string> {
return this.cache.size;
}

entries(): IterableIterator<[string, string]> {
entries() {

@aarsilv aarsilv May 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 context from AI: TS 5.x lib declares Map iterators as MapIterator<…> (not IterableIterator<…>). Inferring the return type lets the override match the base class without hard-coding the new type name.

return this.cache.entries();
}

keys(): IterableIterator<string> {
keys() {
return this.cache.keys();
}

values(): IterableIterator<string> {
values() {
return this.cache.values();
}

[Symbol.iterator](): IterableIterator<[string, string]> {
[Symbol.iterator]() {
return this.cache[Symbol.iterator]();
}

Expand Down
2 changes: 1 addition & 1 deletion src/cache/simple-assignment-cache.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
import {
AbstractAssignmentCache,
NonExpiringInMemoryAssignmentCache,
AssignmentCacheEntry,
} from '@eppo/js-client-sdk-common';
import type { AssignmentCacheEntry } from '@eppo/js-client-sdk-common';

@aarsilv aarsilv May 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 context from AI: AssignmentCacheEntry moved to its own import type line for verbatimModuleSyntax.


import type {
BulkReadAssignmentCache,
Expand Down
14 changes: 8 additions & 6 deletions src/index.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,17 @@
import {

@aarsilv aarsilv May 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 context from AI: Split mixed value/type imports (and re-exports below) so type-only symbols use import type / export type, required by verbatimModuleSyntax.

IAssignmentLogger,
IAssignmentEvent,
validation,
EppoClient,
EppoPrecomputedClient,
MemoryOnlyConfigurationStore,
} from '@eppo/js-client-sdk-common';
import type {
IAssignmentLogger,
IAssignmentEvent,
FlagConfigurationRequestParameters,
IAssignmentDetails,
EppoPrecomputedClient,
IConfigurationStore,
IObfuscatedPrecomputedBandit,
PrecomputedFlag,
MemoryOnlyConfigurationStore,
PrecomputedFlagsRequestParameters,
Subject,
AttributeType,
Expand All @@ -32,11 +34,11 @@ import HybridAssignmentCache from './cache/hybrid-assignment-cache';

import SparkMD5 from 'spark-md5';

export {
export { EppoClient };
export type {
IAssignmentDetails,
IAssignmentLogger,
IAssignmentEvent,
EppoClient,
IClientConfig,
IPrecomputedClientConfig,

Expand Down
2 changes: 1 addition & 1 deletion tsconfig.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
"allowUnreachableCode": false,
"allowUnusedLabels": false,
"esModuleInterop": true,
"importsNotUsedAsValues": "error",
"verbatimModuleSyntax": true,

@aarsilv aarsilv May 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 context from AI: importsNotUsedAsValues was removed in TS 5.5; verbatimModuleSyntax is the modern equivalent — drove the import type splits in src/.

"forceConsistentCasingInFileNames": true,
"jsx": "react",
"lib": ["esnext"],
Expand Down
Loading
Loading