Skip to content

Commit 26e359c

Browse files
committed
deps: Upgrade react-native-webview to 11.6.4, the latest.
To get a version that has the React Native peer dep range bumped to include React Native v0.64, which we hope to upgrade to soon (#4426). There is one announced breaking change for Android; the `setSupportMultipleWindows` prop is introduced, defaulting to `true` [1]. This is to "mitigate the security advisory CVE-2020-6506". The advisory says, "This vulnerability affects React Native apps which use a react-native-webview that allows navigation to arbitrary URLs, and when that app runs on systems with an Android WebView version prior to 83.0.4103.106." I'm skeptical that we were affected, because I don't think we allow navigation to arbitrary URLs; see our comments on our use of the `originWhitelist` and `onShouldStartLoadWithRequest` props. But good that they're addressing reported vulnerabilities. [1] https://github.com/react-native-webview/react-native-webview/releases/tag/v11.0.0
1 parent a18ea87 commit 26e359c

File tree

7 files changed

+1353
-704
lines changed

7 files changed

+1353
-704
lines changed

docs/howto/libdefs.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,26 @@ was like.
9494
[7]: https://flow.org/en/docs/libdefs/creation/
9595
[8]: https://github.com/flow-typed/flow-typed/blob/master/CONTRIBUTING.md#dont-import-types-from-other-libdefs
9696

97+
## `react-native-webview` at 11.6.4
98+
99+
As seen in the entry below, our practice as we update `react-native-webview`
100+
has been to look at diffs in relevant TypeScript files between versions, and
101+
try to translate and apply those to our Flow libdef. Since our starting
102+
point was a libdef from `flow-typed` that was "lacking most of the JSDocs,
103+
and several properties were needlessly in a different order than in the
104+
TypeScript" (see below), though, that process has been kind of frustrating.
105+
106+
So with this upgrade, I did a reset by translating the relevant
107+
`react-native-webview` files (and parts of a file from
108+
`@types/react-native`, which those files depended on) with Flowgen into a
109+
totally fresh libdef. It worked surprisingly well, preserving jsdocs and
110+
ordering. (I think there may have been a glitch with copying jsdocs in the
111+
translation, maybe in @types/react-native, but I was able to run the
112+
`flowgen` command with `--no-jsdoc` and then copy them over by hand.)
113+
114+
Hopefully this will allow us to restart the diffing approach more easily for
115+
future upgrades.
116+
97117
## `react-native-webview` at v7.6
98118

99119
The latest version FlowTyped has a libdef for is 6, unfortunately.

0 commit comments

Comments
 (0)