Skip to content

@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native Community CLI (RCE) #2800

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JohnsonEricAtSalesforce merged 6 commits into from
Nov 17, 2025
Merged

@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native Community CLI (RCE) #2800

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8885dc3
@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…
JohnsonEricAtSalesforce Nov 6, 2025
b2c60ae
@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…
JohnsonEricAtSalesforce Nov 10, 2025
d81bd2d
@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…
JohnsonEricAtSalesforce Nov 10, 2025
68c00e6
@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…
JohnsonEricAtSalesforce Nov 13, 2025
39aa7b2
@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…
JohnsonEricAtSalesforce Nov 13, 2025
e467cee
@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…
JohnsonEricAtSalesforce Nov 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 16 additions & 14 deletions libs/SalesforceReact/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,34 +9,36 @@
"@babel/plugin-transform-private-property-in-object": "^7.24.7",
"create-react-class": "^15.7.0",
"jsc-android": "^250231.0.0",
"react": "19.0.0",
"react-native": "0.79.3",
"react": "19.1.1",
"react-native": "0.82.1",
"@react-native/new-app-screen": "0.82.1",
Copy link
Contributor Author

@JohnsonEricAtSalesforce JohnsonEricAtSalesforce Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wmathurin - Since this is a library module, think we should try to avoid adding the two new dependencies here? The upgrade helper is only available for apps - not libraries. All the other files in the upgrade helper with obvious app-level changes are already absent from our library with this one exception.

Copy link
Contributor

@wmathurin wmathurin Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we only need them in apps.
Also shouldn't you upgrade react-native-force (i.e. SalesforceMobileSDK-ReactNative) first?

"react-native-safe-area-context": "^5.5.2",
"react-native-force": "git+https://github.com/forcedotcom/SalesforceMobileSDK-ReactNative.git#dev"
},
"devDependencies": {
"@babel/core": "^7.25.2",
"@babel/preset-env": "^7.25.3",
"@babel/runtime": "^7.25.0",
"@react-native-community/cli": "18.0.0",
"@react-native-community/cli-platform-android": "18.0.0",
"@react-native-community/cli-platform-ios": "18.0.0",
"@react-native/babel-preset": "0.79.3",
"@react-native/eslint-config": "0.79.3",
"@react-native/metro-config": "0.79.3",
"@react-native/typescript-config": "0.79.3",
"@react-native-community/cli": "20.0.0",
"@react-native-community/cli-platform-android": "20.0.0",
"@react-native-community/cli-platform-ios": "20.0.0",
"@react-native/babel-preset": "0.82.1",
"@react-native/eslint-config": "0.82.1",
"@react-native/metro-config": "0.82.1",
"@react-native/typescript-config": "0.82.1",
"@types/jest": "^29.5.13",
"@types/react": "^19.0.0",
"@types/react-test-renderer": "^19.0.0",
"@types/react": "^19.1.1",
"@types/react-test-renderer": "^19.1.0",
"babel-jest": "^30.0.0",
"chai": "4.4.1",
"eslint": "^8.19.0",
"jest": "^29.6.3",
"metro-react-native-babel-preset": "0.77.0",
"prettier": "2.8.8",
"react-test-renderer": "19.0.0",
"typescript": "5.0.4"
"react-test-renderer": "19.1.1",
"typescript": "^5.8.3"
},
"engines": {
"node": ">=18"
"node": ">=20"
Copy link
Contributor

@brandonpage brandonpage Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to update the versions spreadsheet so this new min version gets added to release notes.

}
}