Skip to content

feat: @lavamoat/react-native-lockdown#16341

Merged
leotm merged 31 commits into
mainfrom
feat/lavamoat-react-native-lockdown
Jul 9, 2025
Merged

feat: @lavamoat/react-native-lockdown#16341
leotm merged 31 commits into
mainfrom
feat/lavamoat-react-native-lockdown

Conversation

@leotm

@leotm leotm commented Jun 12, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Description

Introduce Hardened JavaScript now on both iOS (RN JSC) and Android (Hermes)
via Metro (@lavamoat/react-native-lockdown beta) instead of RN patch
and remove old iOS UI from: Settings > Experimental > Security

TODO

Related issues

Fixes:

Manual testing steps

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

@socket-security

socket-security Bot commented Jun 12, 2025 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednpm/​@​lavamoat/​react-native-lockdown@​0.0.2100100100100100

View full report

leotm added 16 commits June 17, 2025 11:23
@leotm
feat: @lavamoat/react-native-lockdown
c570783
@leotm
fix: ses v1.13.x patch
2a49862 
- endojs/endo#2855
- iOS on RN JSC up and running again with SES
- Android on Hermes working as expecting with SES
@leotm
chore: remove prev metro config comments
2d96583
@leotm
refactor: remove console logs
e59b9dc
@leotm
feat: metro config compat with 'react native bundle'
53703d3
@leotm
refactor: metro config parsed args
fa035a2
@leotm
feat: metro config compat with 'expo'
30d55e7
@leotm
feat: metro config compat with 'watchman'
fd0df84
@leotm
refactor: metro config hermesRuntime and getPolyfills
4a49141
@leotm
feat: metro config compat with remaining commands
d81c5bf
@leotm
fix: metro config compat with '--device' no value
6dc0a24
@leotm
fix: metro config compat with all 'android' scripts
a477223
@leotm
docs: metro config 'expo start' not supported
2686515
@leotm
chore: remove stale prototype pollution test comment
3a251f8
@leotm
chore: deduplicate lockfile
e9134c5
@leotm
refactor: simplify metro config a lot
6b84656
@leotm leotm force-pushed the feat/lavamoat-react-native-lockdown branch from e5c6230 to 6b84656 Compare June 17, 2025 10:24
@github-actions

github-actions Bot commented Jun 17, 2025

Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@sethkfman

sethkfman commented Jun 17, 2025

Copy link
Copy Markdown
Contributor

Passing Smoke E2E: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/f209fd93-e170-49a2-b908-44fbee9dc124

@leotm

leotm commented Jun 19, 2025

Copy link
Copy Markdown
Contributor Author

Passing Smoke E2E: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/606d9216-a472-4e4f-92ce-b08ada66743b

@leotm

leotm commented Jun 19, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Failing Regression E2E: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/6b1a7d83-e953-4d96-b15d-a21366ccdbbf

  • iOS: 6/14
  • Android: 8/14

NB: passed on main May 27 https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/4697868f-2919-4d5d-b643-a6a34cb7d3bc so currently expected

@leotm leotm force-pushed the feat/lavamoat-react-native-lockdown branch 3 times, most recently from a7c17dc to 431a97e Compare July 8, 2025 15:22
@github-actions

This comment was marked as resolved.

Sign in to view
@leotm leotm force-pushed the feat/lavamoat-react-native-lockdown branch from 431a97e to c74d8d0 Compare July 8, 2025 17:06
@github-actions

This comment was marked as outdated.

Sign in to view
@github-actions

github-actions Bot commented Jul 8, 2025 •
edited by metamaskbot
Loading

Copy link
Copy Markdown
Contributor

https://bitrise.io/ Bitrise

✅✅✅ pr_smoke_e2e_pipeline passed on Bitrise! ✅✅✅

Commit hash: 1fd2dd1
Build link: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/2caf7571-9df8-448b-a8f6-7a002e93070a

Note

  • You can kick off another pr_smoke_e2e_pipeline on Bitrise by removing and re-applying the Run Smoke E2E label on the pull request

@sonarqubecloud

sonarqubecloud Bot commented Jul 8, 2025

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

boneskull
boneskull approved these changes Jul 8, 2025
View reviewed changes

@boneskull boneskull left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm (take that as you will)

Comment thread metro.config.js
@leotm leotm added this pull request to the merge queue Jul 9, 2025
Merged via the queue into main with commit 9e2e2be Jul 9, 2025
56 of 57 checks passed
@leotm leotm deleted the feat/lavamoat-react-native-lockdown branch July 9, 2025 12:23
@github-actions github-actions Bot locked and limited conversation to collaborators Jul 9, 2025
@metamaskbot metamaskbot added release-7.52.0 Issue or pull request that will be included in release 7.52.0 INVALID-PR-TEMPLATE PR's body doesn't match template labels Jul 9, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

@boneskull boneskull boneskull approved these changes

@chrisleewilcox chrisleewilcox chrisleewilcox approved these changes

@vinnyhoward vinnyhoward vinnyhoward approved these changes

@joaoloureirop joaoloureirop joaoloureirop approved these changes

+1 more reviewer

@darkwing darkwing darkwing approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@leotm leotm

Labels

INVALID-PR-TEMPLATE PR's body doesn't match template QA Passed QA testing has been completed and passed release-7.52.0 Issue or pull request that will be included in release 7.52.0 team-lavamoat

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@leotm @sethkfman @darkwing @boneskull @chrisleewilcox @vinnyhoward @joaoloureirop @metamaskbot