microsoft / microsoft/react-native-windows
Component Governance will be unable to detect the hermes dependency in RN
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 17.3k
- Forks
- 1.2k
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 33
Description
Problem Description
RNW does not actually depend on the published hermes NPM package (as of #10210), because technically neither does RN.
However, RN does release with hermes binaries within their NPM package, which Component Governance won't be able to detect.
So all RN (and therefore RNW apps) built by MSFT running internal compliance tools will be missing this dependency, which, as a JS engine, is ripe for future security vulnerabilities.
Steps To Reproduce
- Create a new react-native app
npx react-native init testapp - Look under
node_modules/react-native/sdks, you'll see versions of hermes.
Expected Results
No response
CLI version
npx react-native --version
Environment
npx react-native info
Target Platform Version
No response
Target Device(s)
No response
Visual Studio Version
No response
Build Configuration
No response
Snack, code example, screenshot, or link to a repository
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no repository files. Reproduce with npx react-native init testapp and inspect node_modules/react-native/sdks for bundled Hermes versions, then trace how Component Governance discovers dependencies. Done means the bundled Hermes dependency is detected for RN and RNW apps.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react-native
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100