Skip to content

Modify React DevTools for Replay integration - #2

Closed
markerikson wants to merge 2918 commits into
mainfrom
feature/replay-react-devtools
Closed

Modify React DevTools for Replay integration#2
markerikson wants to merge 2918 commits into
mainfrom
feature/replay-react-devtools

Conversation

@markerikson

Copy link
Copy Markdown

This is a draft PR for visibility.

When I implemented our Chromium support for React DevTools via backend "routines" (as described in https://blog.replay.io/how-we-rebuilt-react-devtools-with-replay-routines ), I forked the React DevTools to make a number of internal changes, such as saving operations data separately and persisting "marker" annotations to Replay's backend.

Along the way I also tried to shrink down the size of the JS bundle artifacts that we were evaluating in our backend paused browser instances. They were originally around 500K+, and I was able to knock off about 60-70K of that by removing code that's irrelevant for our use case.

mondaychen pushed a commit to react/react that referenced this pull request Feb 9, 2023
…bundle size (#26122)
<!--
Thanks for submitting a pull request!
We appreciate you spending the time to work on these changes. Please
provide enough information so that others can review your pull request.
The three fields below are mandatory.
Before submitting a pull request, please make sure the following is
done:
1. Fork [the repository](https://github.com/facebook/react) and create
your branch from `main`.
2. Run `yarn` in the repository root.
3. If you've fixed a bug or added code that should be tested, add tests!
4. Ensure the test suite passes (`yarn test`). Tip: `yarn test --watch
TestName` is helpful in development.
5. Run `yarn test --prod` to test in the production environment. It
supports the same options as `yarn test`.
6. If you need a debugger, run `yarn debug-test --watch TestName`, open
`chrome://inspect`, and press "Inspect".
7. Format your code with
[prettier](https://github.com/prettier/prettier) (`yarn prettier`).
8. Make sure your code lints (`yarn lint`). Tip: `yarn linc` to only
check changed files.
9. Run the [Flow](https://flowtype.org/) type checks (`yarn flow`).
10. If you haven't already, complete the CLA.
Learn more about contributing:
https://reactjs.org/docs/how-to-contribute.html
-->
## Summary
This PR:
- Replaces the existing usages of methods from the `semver` library in
the React DevTools source with an inlined version based on
https://www.npmjs.com/package/semver-compare.
This appears to drop the unminified bundle sizes of 3 separate
`react-devtools-extensions` build artifacts by about 50K:
![image](https://user-images.githubusercontent.com/1128784/217326947-4c26d1be-d834-4f77-9e6e-be2d5ed0954d.png)
## How did you test this change?
I was originally working on [a fork of React
DevTools](replayio#2) for use with
https://replay.io , specifically our integration of the React DevTools
UI to show the React component tree while users are debugging a recorded
application.
As part of the dev work on that fork, I wanted to shrink the bundle size
of the extension's generated JS build artifacts. I noted that the
official NPM `semver` library was taking up a noticeable chunk of space
in the bundles, and saw that it's only being used in a handful of places
to do some very simple version string comparisons.
I was able to replace the `semver` imports and usages with a simple
alternate comparison function, and confirmed via hands-on checks and
console logging that the checks behaved the same way.
Given that, I wanted to upstream this particular change to help shrink
the real extension's bundle sizes.
I know that it's an extension, so bundle size isn't _as_ critical a
concern as it would be for a pure library. But, smaller download sizes
do benefit all users, and that also includes sites like CodeSandbox and
Replay that are using the React DevTools as a library as well.
I'm happy to tweak this PR if necessary. Thanks!
github-actionsBot pushed a commit to react/react that referenced this pull request Feb 9, 2023
…bundle size (#26122)
<!--
Thanks for submitting a pull request!
We appreciate you spending the time to work on these changes. Please
provide enough information so that others can review your pull request.
The three fields below are mandatory.
Before submitting a pull request, please make sure the following is
done:
1. Fork [the repository](https://github.com/facebook/react) and create
your branch from `main`.
2. Run `yarn` in the repository root.
3. If you've fixed a bug or added code that should be tested, add tests!
4. Ensure the test suite passes (`yarn test`). Tip: `yarn test --watch
TestName` is helpful in development.
5. Run `yarn test --prod` to test in the production environment. It
supports the same options as `yarn test`.
6. If you need a debugger, run `yarn debug-test --watch TestName`, open
`chrome://inspect`, and press "Inspect".
7. Format your code with
[prettier](https://github.com/prettier/prettier) (`yarn prettier`).
8. Make sure your code lints (`yarn lint`). Tip: `yarn linc` to only
check changed files.
9. Run the [Flow](https://flowtype.org/) type checks (`yarn flow`).
10. If you haven't already, complete the CLA.
Learn more about contributing:
https://reactjs.org/docs/how-to-contribute.html
-->
## Summary
This PR:
- Replaces the existing usages of methods from the `semver` library in
the React DevTools source with an inlined version based on
https://www.npmjs.com/package/semver-compare.
This appears to drop the unminified bundle sizes of 3 separate
`react-devtools-extensions` build artifacts by about 50K:
![image](https://user-images.githubusercontent.com/1128784/217326947-4c26d1be-d834-4f77-9e6e-be2d5ed0954d.png)
## How did you test this change?
I was originally working on [a fork of React
DevTools](replayio#2) for use with
https://replay.io , specifically our integration of the React DevTools
UI to show the React component tree while users are debugging a recorded
application.
As part of the dev work on that fork, I wanted to shrink the bundle size
of the extension's generated JS build artifacts. I noted that the
official NPM `semver` library was taking up a noticeable chunk of space
in the bundles, and saw that it's only being used in a handful of places
to do some very simple version string comparisons.
I was able to replace the `semver` imports and usages with a simple
alternate comparison function, and confirmed via hands-on checks and
console logging that the checks behaved the same way.
Given that, I wanted to upstream this particular change to help shrink
the real extension's bundle sizes.
I know that it's an extension, so bundle size isn't _as_ critical a
concern as it would be for a pure library. But, smaller download sizes
do benefit all users, and that also includes sites like CodeSandbox and
Replay that are using the React DevTools as a library as well.
I'm happy to tweak this PR if necessary. Thanks!
DiffTrain build for [78d2e9e](78d2e9e)
[View git log for this commit](https://github.com/facebook/react/commits/78d2e9e2a894a7ea9aa3f9faadfc4c6038e86a75)
@markerikson
markeriksonforce-pushed the feature/replay-react-devtools branch from a34bbbe to 8e163adCompareMarch 15, 2023 17:12
@bvaughn

bvaughn commented Oct 19, 2023

Copy link
Copy Markdown

Note for future me:

Building

I'm running Node v18 and the build:chrome step failed for me with an ERR_OSSL_EVP_UNSUPPORTED error. The work around was to use the --openssl-legacy-provider flag.

 NODE_OPTIONS=--openssl-legacy-provider yarn build:chrome

Releasing

Then I had to copy the contents of <react-root>/packages/react-devtools-extension/chrome/build/unpacked/build/react_devtools_backend_compact.js into <replay-root>/src/ui/components/SecondaryToolbox/react-devtools/react_devtools_backend.raw.js

Comment threadpackages/react-devtools-shared/src/backend/renderer.js
@bvaughn
bvaughnforce-pushed the feature/replay-react-devtools branch from 3a87e14 to 6732942CompareOctober 20, 2023 14:49
jerrydev0927 added a commit to jerrydev0927/react that referenced this pull request Jan 5, 2024
…bundle size (#26122)
<!--
Thanks for submitting a pull request!
We appreciate you spending the time to work on these changes. Please
provide enough information so that others can review your pull request.
The three fields below are mandatory.
Before submitting a pull request, please make sure the following is
done:
1. Fork [the repository](https://github.com/facebook/react) and create
your branch from `main`.
2. Run `yarn` in the repository root.
3. If you've fixed a bug or added code that should be tested, add tests!
4. Ensure the test suite passes (`yarn test`). Tip: `yarn test --watch
TestName` is helpful in development.
5. Run `yarn test --prod` to test in the production environment. It
supports the same options as `yarn test`.
6. If you need a debugger, run `yarn debug-test --watch TestName`, open
`chrome://inspect`, and press "Inspect".
7. Format your code with
[prettier](https://github.com/prettier/prettier) (`yarn prettier`).
8. Make sure your code lints (`yarn lint`). Tip: `yarn linc` to only
check changed files.
9. Run the [Flow](https://flowtype.org/) type checks (`yarn flow`).
10. If you haven't already, complete the CLA.
Learn more about contributing:
https://reactjs.org/docs/how-to-contribute.html
-->
## Summary
This PR:
- Replaces the existing usages of methods from the `semver` library in
the React DevTools source with an inlined version based on
https://www.npmjs.com/package/semver-compare.
This appears to drop the unminified bundle sizes of 3 separate
`react-devtools-extensions` build artifacts by about 50K:
![image](https://user-images.githubusercontent.com/1128784/217326947-4c26d1be-d834-4f77-9e6e-be2d5ed0954d.png)
## How did you test this change?
I was originally working on [a fork of React
DevTools](replayio/react#2) for use with
https://replay.io , specifically our integration of the React DevTools
UI to show the React component tree while users are debugging a recorded
application.
As part of the dev work on that fork, I wanted to shrink the bundle size
of the extension's generated JS build artifacts. I noted that the
official NPM `semver` library was taking up a noticeable chunk of space
in the bundles, and saw that it's only being used in a handful of places
to do some very simple version string comparisons.
I was able to replace the `semver` imports and usages with a simple
alternate comparison function, and confirmed via hands-on checks and
console logging that the checks behaved the same way.
Given that, I wanted to upstream this particular change to help shrink
the real extension's bundle sizes.
I know that it's an extension, so bundle size isn't _as_ critical a
concern as it would be for a pure library. But, smaller download sizes
do benefit all users, and that also includes sites like CodeSandbox and
Replay that are using the React DevTools as a library as well.
I'm happy to tweak this PR if necessary. Thanks!
DiffTrain build for [78d2e9e2a894a7ea9aa3f9faadfc4c6038e86a75](react/react@78d2e9e)
[View git log for this commit](https://github.com/facebook/react/commits/78d2e9e2a894a7ea9aa3f9faadfc4c6038e86a75)
rickhanloniiand others added 22 commits April 26, 2024 16:03
)
## Summary
I'm looking at cleaning up some unnecessary manual property flattening
in React Native and wanted to verify this behaviour is working as
expected, where properties from nested objects will always overwrite
properties from the base object.
## How did you test this change?
Unit tests
Move useMemoCache hook to react/compiler-runtime
For Meta-internal purposes, we keep the export on `react` itself to
reduce churn.
Enables the Reanimated flag automatically if we find reanimated in the
user's list of plugins
ghstack-source-id: 20e83374612362a30d6c8cc7a903d9320e8cc23a
Pull Request resolved: https://github.com/facebook/react-forget/pull/2915
ghstack-source-id: 79f3319d87909d05731ef821d0ffe86cb01b0432
Pull Request resolved: https://github.com/facebook/react-forget/pull/2920
Show compiling status message and not just block
UI.
ghstack-source-id: 67761c5d32216e105c4aa6404dfa07d76ae22583
Pull Request resolved: https://github.com/facebook/react-forget/pull/2921
ghstack-source-id: f05222073be785b77346c4e8760bf4d0bb4d658e
Pull Request resolved: https://github.com/facebook/react-forget/pull/2922
Add a configurable list of known incompatible libraries.
Check all package.jsons for any uses of known incompatible libraries and
warn if found.
ghstack-source-id: 7329e3792b57458e681780cba3140a14a9b1a60d
Pull Request resolved: https://github.com/facebook/react-forget/pull/2923
Makes it easier to extend later, if we want to add more checks.
ghstack-source-id: 6fb3435555f1b988e1a185bfda8be9418eb622c5
Pull Request resolved: https://github.com/facebook/react-forget/pull/2924
Treat MethodCalls similar to general CallExpressions and mark them
as escaping in PruneNonEscapingScopes pass.
ghstack-source-id: 3c81bdb17f58fbeef8be24e7cb363172d1867217
Pull Request resolved: https://github.com/facebook/react-forget/pull/2925
…#2918)
This uses the compiler runtime from `react/compiler-runtime` by default unless `compilerRuntime` is specifified in the Babel options which then imports the runtime from there. The `useMemoCache` hook is now named `c` in accordance with react@4508873
Unfortunately, I couldn't figure out how to import `react@beta` which already has that import as various react verstions were conflicting. If someone can figure this out it'd be fantastic. As a result, I had to update the default for the test runner to default the `compilerRuntime` option to `react` to preserve the previous behavior to import from `react`. Once upgraded to React 19, we should be able to remove that override.
To make a first time setup of the compiler truly config-less, default to
not compiling node_modules unless a user provided `sources` (advanced
option) is provided
ghstack-source-id: b0798052404d772ce6ee471e577699d4b0871d56
Pull Request resolved: https://github.com/facebook/react-forget/pull/2919
When a React PR is opened CI will report large size changes. But for
critical packages like react-dom it reports always. In React 19 we moved
the build for react-dom the client reconciler from react-dom to
react-dom/client
This change adds react-dom-client artifacts for stable and oss channels
since that is originally what was being tracked. But since
react-dom/client always imports react-dom I left the original react-dom
packages as critical as well. They are small but it would be good to
keep an eye on them
## Summary
This PR introduces a faster version of the `addProperties` function.
This new function is basically the `diffProperties` with `prevProps` set
to `null`, propagated constants, and all the unreachable code paths
collapsed.
## How did you test this change?
I've tested this change with [the benchmark
app](https://github.com/react-native-community/RNNewArchitectureApp/tree/new-architecture-benchmarks)
and got ~4.4% improvement in the view creation time.
ghstack-source-id: bb66913e2d3c814696311371ed655f3da03d1199
Pull Request resolved: facebook/react-forget#2926
ghstack-source-id: cce73f26b7b3903b8d79b70dbc24cbee09693d81
Pull Request resolved: facebook/react-forget#2927
mvitousekand others added 25 commits May 31, 2024 14:06
Summary: jmbrown215 recently had an observation that the arguments to useState/useRef are only used when a component renders for the first time, and never afterwards. We can skip more computation that we previously could, with reactive blocks that previously recomputed values when inputs changed now only ever computing them on the first render.
ghstack-source-id: 5d044ef
Pull Request resolved: react#29653
Summary: This PR expands the analysis from the previous in the stack in order to also capture when a value can incorrectly change within a single render, rather than just changing between two renders. In the case where dependencies have changed and so a new value is being computed, we now compute the value twice and compare the results. This would, for example, catch when we call Math.random() in render.
The generated code is a little convoluted, because we don't want to have to traverse the generated code and substitute variable names with new ones. Instead, we save the initial value to the cache as normal, then run the computation block again and compare the resulting values to the cached ones. Then, to make sure that the cached values are identical to the computed ones, we reassign the cached values into the output variables.
ghstack-source-id: d0f11a4
Pull Request resolved: react#29657
…ive scopes for debugging
Summary: Using the change detection code to debug codebases that violate the rules of react is a lot easier when we have a source location corresponding to the value that has changed inappropriately. I didn't see an easy way to track that information in the existing data structures at the point of codegen, so this PR adds locations to identifiers and reactive scopes (the location of a reactive scope is the range of the locations of its included identifiers).
I'm interested if there's a better way to do this that I missed!
ghstack-source-id: aed5f7e
Pull Request resolved: react#29658
…9670)
When a component suspends with `use`, we switch to the "re-render"
dispatcher during the subsequent render attempt, so that we can reuse
the work from the initial attempt. However, once we run out of hooks
from the previous attempt, we should switch back to the regular "update"
dispatcher.
This is conceptually the same fix as the one introduced in
react#26232. That fix only accounted
for initial mount, but the useTransition regression test added in
f829733 illustrates that we need to
handle updates, too.
The issue affects more than just useTransition but because most of the
behavior between the "re-render" and "update" dispatchers is the same
it's hard to contrive other scenarios in a test, which is probably why
it took so long for someone to notice.
Closesreact#28923 and react#29209
---------
Co-authored-by: eps1lon <sebastian.silbermann@vercel.com>
Eslint rules should never throw, so if we fail to parse with Babel or
Hermes, we should just ignore the error. This should fix issues such as
trying to run the eslint rule on non tsx|ts|jsx|js files, Hermes parser
not supporting certain JS syntax, etc.
I didn't add a test for this as our eslint-rule-tester config uses
hermes-eslint parser, so it wasn't possible to add a top level await as
it would crash hermes-eslint before our rule was triggered. Similarly I
couldn't add a test for non-JS files as it would not be parseable by
hermes-eslint.
Fixesreact#29107
ghstack-source-id: 60afcdb
Pull Request resolved: react#29631
…ce maps from (react#29708)
This lets you click a stack frame on the client and see the Server
source code inline.
<img width="871" alt="Screenshot 2024-06-01 at 11 44 24 PM"
src="https://github.com/facebook/react/assets/63648/581281ce-0dce-40c0-a084-4a6d53ba1682">
<img width="840" alt="Screenshot 2024-06-01 at 11 43 37 PM"
src="https://github.com/facebook/react/assets/63648/00dc77af-07c1-4389-9ae0-cf1f45199efb">
We could do some logic on the server that sends a source map url for
every stack frame in the RSC payload. That would make the client
potentially config free. However regardless we need the config to
describe what url scheme to use since that’s not built in to the bundler
config. In practice you likely have a common pattern for your source
maps so no need to send data over and over when we can just have a
simple function configured on the client.
The server must return a source map, even if the file is not actually
compiled since the fake file is still compiled.
The source mapping strategy can be one of two models depending on if the
server’s stack traces (`new Error().stack`) are source mapped back to
the original (`—enable-source-maps`) or represents the location in
compiled code (like in the browser).
If it represents the location in compiled code it’s actually easier. You
just serve the source map generated for that file by the tooling.
If it is already source mapped it has to generate a source map where
everything points to the same location (as if not compiled) ideally with
a segment per logical ast node.
Requires react#29706
The strategy here is to:
- Checkout the builds/facebook-www branch
- Read the current sync'd VERSION
- Checkout out main and sync new build
- sed/{new version string}/{old version string}
- Run git status, skip sync if clean
- Otherwise, sed/{old version string}/{new version string} and push
commit
This means that:
- We're using the real version strings from the builds
- We are checking the last commit on the branch for the real last
version
- We're skipping any commits that won't result in changes
- ???
- Profit!
Host Components can exist as four semantic types
1. regular Components (Vanilla obv)
2. singleton Components
2. hoistable components
3. resources
Each of these component types have their own rules related to mounting
and reconciliation however they are not direclty modeled as their own
unique fiber type. This is partly for code size but also because
reconciling the inner type of these components would be in a very hot
path in fiber creation and reconciliation and it's just not practical to
do this logic check here.
Right now we have three Fiber types used to implement these 4 concepts
but we probably need to reconsider the model and think of Host
Components as a single fiber type with an inner implementation. Once we
do this we can regularize things like transitioning between a resource
and a regular component or a singleton and a hoistable instance. The
cases where these transitions happen today aren't particularly common
but they can be observed and currently the handling of these transitions
is incomplete at best and buggy at worst. The most egregious case is the
link type. This can be a regular component (stylesheet without
precedence) a hoistable component (non stylesheet link tags) or a
resource (stylesheet with a precedence) and if you have a single jsx
slot that tries to reconcile transitions between these types it just
doesn't work well.
This commit adds an error for when a Hoistable goes from Instance to
Resource. Currently this is only possible for `<link>` elements going to
and from stylesheets with precedence. Hopefully we'll be able to remove
this error and implement as an inner type before we encounter new
categories for the Hoistable types
detecting type shifting to and from regular components is harder to do
efficiently because we don't want to reevaluate the type on every update
for host components which is currently not required and would add
overhead to a very hot path
singletons can't really type shift in their one practical implementation
(DOM) so they are only a problem in theroy not practice
Mini-refactor of useActionState to only wrap the action in a transition
context if the dispatch is called during a transition. Conceptually, the
action starts as soon as the dispatch is called, even if the action is
queued until earlier ones finish.
We will also warn if an async action is dispatched outside of a
transition, since that is almost certainly a mistake. Ideally we would
automatically upgrade these to a transition, but we don't have a great
way to tell if the action is async until after it's already run.
Based on
- react#29694 ---
If an action in the useActionState queue errors, we shouldn't run any
subsequent actions. The contract of useActionState is that the actions
run in sequence, and that one action can assume that all previous
actions have completed successfully.
For example, in a shopping cart UI, you might dispatch an "Add to cart"
action followed by a "Checkout" action. If the "Add to cart" action
errors, the "Checkout" action should not run.
An implication of this change is that once useActionState falls into an
error state, the only way to recover is to reset the component tree,
i.e. by unmounting and remounting. The way to customize the error
handling behavior is to wrap the action body in a try/catch.
RC releases are a special kind of prerelease build because unlike
canaries we shouldn't publish new RCs from any commit on `main`, only
when we intentionally bump the RC number. But they are still prerelases
— like canary and experimental releases, they should use exact version
numbers in their dependencies (no ^).
We only need to generate these builds during the RC phase, i.e. when the
canary channel label is set to "rc".
Example of resulting package.json output:
```json
{
"name": "react-dom",
"version": "19.0.0-rc.0",
"dependencies": {
"scheduler": "0.25.0-rc.0"
},
"peerDependencies": {
"react": "19.0.0-rc.0"
}
}
```
https://react-builds.vercel.app/prs/29736/files/oss-stable-rc/react-dom/package.json
react#29697)
This information is available in the regular stack but since that's
hidden behind an expando and our appended stack to logs is not hidden,
it hides the most important frames like the name of the current
component.
This is closer to what happens to the native stack.
We only include stacks if they're within a ReactFiberCallUserSpace call
frame. This should be most that have a current fiber but this is
critical to filtering out most React frames if the regular node_modules
filter doesn't work.
Most React warnings fire during the rendering phase and not inside a
user space function but some do like hooks warnings and setState in
render. This feature is more important if we port this to React DevTools
appending stacks to all logs where it's likely to originate from inside
a component and you want the line within that component to immediately
part of the visible stack.
One thing that kind sucks is that we don't have a reliable way to
exclude React internal stack frames. We filter node_modules but it might
not match. For other cases I try hard to only track the stack frame at
the root of React (e.g. immediately inside createElement) until the
ReactFiberCallUserSpace so we don't need the filtering to work. In this
case it's hard to achieve the same thing though. This is easier in RDT
because we have the start/end line and parsing of stack traces so we can
use that to exclude internals but that's a lot of code/complexity for
shipping within the library.
For example in Safari:
<img width="590" alt="Screenshot 2024-05-31 at 6 15 27 PM"
src="https://github.com/facebook/react/assets/63648/2820c8c0-8a03-42e9-8678-8348f66b051a">
Ideally warnOnUseFormStateInDev and useFormState wouldn't be included
since they're React internals. Before this change, the Counter.js line
also wasn't included though which points to exactly where the error is
within the user code.
(Note Server Components have V8 formatted lines and Client Components
have JSC formatted lines.)
Use some clever git diffing to ignore lines that only change the
`@generated` header. We can't do this for the version string because the
version string can be embedded in lines with other changes, but this
header is always on one line.
…ed (react#29720)
Following the instructions in the compiler/docs/DEVELOPMENT_GUIDE.md, we are stuck on the command `yarn snap --watch` because it calls readTestFilter even though the filter option is not enabled.
www: set enableRefAsProp to true
… of react (react#29753)
<!--
Thanks for submitting a pull request!
We appreciate you spending the time to work on these changes. Please
provide enough information so that others can review your pull request.
The three fields below are mandatory.
Before submitting a pull request, please make sure the following is
done:
1. Fork [the repository](https://github.com/facebook/react) and create
your branch from `main`.
2. Run `yarn` in the repository root.
3. If you've fixed a bug or added code that should be tested, add tests!
4. Ensure the test suite passes (`yarn test`). Tip: `yarn test --watch
TestName` is helpful in development.
5. Run `yarn test --prod` to test in the production environment. It
supports the same options as `yarn test`.
6. If you need a debugger, run `yarn test --debug --watch TestName`,
open `chrome://inspect`, and press "Inspect".
7. Format your code with
[prettier](https://github.com/prettier/prettier) (`yarn prettier`).
8. Make sure your code lints (`yarn lint`). Tip: `yarn linc` to only
check changed files.
9. Run the [Flow](https://flowtype.org/) type checks (`yarn flow`).
10. If you haven't already, complete the CLA.
Learn more about contributing:
https://reactjs.org/docs/how-to-contribute.html
-->
## Summary
Remove `startTransition` and `useActionState` from `react-server`
condition of react, as they should only stay in client bundle.
This will reduce the server bundle of react itself. Found this while tracing where the `process.emit` was called.
<!--
Explain the **motivation** for making this change. What existing problem
does the pull request solve?
-->
## How did you test this change?
<!--
Demonstrate the code is solid. Example: The exact commands you ran and
their output, screenshots / videos if the pull request changes the user
interface.
How exactly did you verify that your PR solves the issue you wanted to
solve?
If you leave this empty, your PR will very likely be closed.
-->
## Overview
We didn't have any tests that ran in persistent mode with the xplat
feature flags (for either variant).
As a result, invalid test gating like in
react#29664 were not caught.
This PR adds test flavors for `ReactFeatureFlag-native-fb.js` in both
variants.
@socket-security

Copy link
Copy Markdown

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

PackageNew capabilitiesTransitivesSizePublisher
npm/@aashutoshrathi/word-wrap@1.2.6None010.9 kBaashutoshrathi
npm/@alloc/quick-lru@5.2.0None014.1 kBaleclarson
npm/@babel/cli@7.24.1Transitive: environment, eval, filesystem, network, shell+221.63 MBnicolo-ribaudo
npm/@babel/code-frame@7.24.2environment+4114 kBnicolo-ribaudo
npm/@babel/compat-data@7.22.3None058.1 kBnicolo-ribaudo
npm/@babel/core@7.2.0filesystem0133 kBnicolo-ribaudo
npm/@babel/core@7.24.4environment, filesystem, unsafe Transitive: shell+305.56 MBnicolo-ribaudo
npm/@babel/generator@7.2.0None0108 kBnicolo-ribaudo
npm/@babel/generator@7.24.4None+3624 kBnicolo-ribaudo
npm/@babel/helper-builder-binary-assignment-operator-visitor@7.22.3Transitive: environment+12.41 MBnicolo-ribaudo
npm/@babel/helper-compilation-targets@7.22.1None+1119 kBnicolo-ribaudo
npm/@babel/helper-create-class-features-plugin@7.22.9Transitive: environment+32.64 MBnicolo-ribaudo
npm/@babel/helper-create-regexp-features-plugin@7.22.1None+8780 kBnicolo-ribaudo
npm/@babel/helper-plugin-utils@7.21.5None011.9 kBnicolo-ribaudo
npm/@babel/helper-plugin-utils@7.24.5None0130 kBnicolo-ribaudo
npm/@babel/helper-replace-supers@7.22.9None032 kBnicolo-ribaudo
npm/@babel/helper-split-export-declaration@7.24.5Transitive: environment+22.47 MBnicolo-ribaudo
npm/@babel/helper-string-parser@7.23.4None031.6 kBnicolo-ribaudo
npm/@babel/helper-validator-option@7.21.0None011.4 kBnicolo-ribaudo
npm/@babel/helpers@7.19.0None0424 kBnicolo-ribaudo
npm/@babel/highlight@7.24.5environment020.3 kBnicolo-ribaudo
npm/@babel/parser@7.19.1None01.93 MBnicolo-ribaudo
npm/@babel/parser@7.24.4None01.88 MBnicolo-ribaudo
npm/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.22.3None+177 kBnicolo-ribaudo
npm/@babel/plugin-proposal-private-property-in-object@7.21.10None+124.1 kBnicolo-ribaudo
npm/@babel/plugin-syntax-flow@7.21.4None05.42 kBnicolo-ribaudo
npm/@babel/plugin-syntax-import-assertions@7.20.0None03.5 kBnicolo-ribaudo
npm/@babel/plugin-syntax-import-attributes@7.22.3None05.12 kBnicolo-ribaudo
npm/@babel/plugin-syntax-jsx@7.21.4None04.13 kBnicolo-ribaudo
npm/@babel/plugin-syntax-jsx@7.23.3None04.21 kBnicolo-ribaudo
npm/@babel/plugin-syntax-typescript@7.18.6None03.9 kBnicolo-ribaudo
npm/@babel/plugin-transform-arrow-functions@7.21.5None05.54 kBnicolo-ribaudo
npm/@babel/plugin-transform-async-generator-functions@7.22.3None020.4 kBnicolo-ribaudo
npm/@babel/plugin-transform-async-to-generator@7.20.7None07.61 kBnicolo-ribaudo
npm/@babel/plugin-transform-class-properties@7.22.3None04.86 kBnicolo-ribaudo
npm/@babel/plugin-transform-class-static-block@7.22.3None010.1 kBnicolo-ribaudo
npm/@babel/plugin-transform-classes@7.21.0None083.8 kBnicolo-ribaudo
npm/@babel/plugin-transform-computed-properties@7.21.5Transitive: environment+34.5 MBnicolo-ribaudo
npm/@babel/plugin-transform-destructuring@7.21.3None081.6 kBnicolo-ribaudo
npm/@babel/plugin-transform-dynamic-import@7.22.1None06.16 kBnicolo-ribaudo
npm/@babel/plugin-transform-export-namespace-from@7.22.3None08.11 kBnicolo-ribaudo
npm/@babel/plugin-transform-flow-strip-types@7.21.0None017.5 kBnicolo-ribaudo
npm/@babel/plugin-transform-for-of@7.21.5None043.2 kBnicolo-ribaudo
npm/@babel/plugin-transform-json-strings@7.22.3None05.8 kBnicolo-ribaudo
npm/@babel/plugin-transform-logical-assignment-operators@7.22.3None08.68 kBnicolo-ribaudo
npm/@babel/plugin-transform-modules-amd@7.20.11None020 kBnicolo-ribaudo
npm/@babel/plugin-transform-modules-systemjs@7.22.3None064.6 kBnicolo-ribaudo
npm/@babel/plugin-transform-named-capturing-groups-regex@7.22.3None04.87 kBnicolo-ribaudo
npm/@babel/plugin-transform-new-target@7.22.3None010.3 kBnicolo-ribaudo
npm/@babel/plugin-transform-nullish-coalescing-operator@7.22.3None09.11 kBnicolo-ribaudo
npm/@babel/plugin-transform-numeric-separator@7.22.3None05.38 kBnicolo-ribaudo
npm/@babel/plugin-transform-object-rest-spread@7.22.3None+1140 kBnicolo-ribaudo
npm/@babel/plugin-transform-optional-catch-binding@7.22.3None04.8 kBnicolo-ribaudo
npm/@babel/plugin-transform-private-methods@7.22.3None04.68 kBnicolo-ribaudo
npm/@babel/plugin-transform-private-property-in-object@7.22.3None+122.7 kBnicolo-ribaudo
npm/@babel/plugin-transform-react-display-name@7.18.6None05.26 kBnicolo-ribaudo
npm/@babel/plugin-transform-react-display-name@7.23.3None012.5 kBnicolo-ribaudo
npm/@babel/plugin-transform-react-jsx-development@7.18.6None+182.7 kBnicolo-ribaudo
npm/@babel/plugin-transform-react-jsx@7.23.4None+1134 kBnicolo-ribaudo
npm/@babel/plugin-transform-react-pure-annotations@7.18.6None04.02 kBnicolo-ribaudo
npm/@babel/plugin-transform-react-pure-annotations@7.23.3Transitive: environment+12.42 MBnicolo-ribaudo
npm/@babel/plugin-transform-regenerator@7.21.5None+1141 kBnicolo-ribaudo
npm/@babel/plugin-transform-spread@7.20.7None020.8 kBnicolo-ribaudo
npm/@babel/plugin-transform-typescript@7.19.1None0111 kBnicolo-ribaudo
npm/@babel/plugin-transform-unicode-escapes@7.21.5None014 kBnicolo-ribaudo
npm/@babel/plugin-transform-unicode-property-regex@7.22.3None04.99 kBnicolo-ribaudo
npm/@babel/plugin-transform-unicode-sets-regex@7.22.3None04.66 kBnicolo-ribaudo
npm/@babel/preset-env@7.22.4environment+9698 kBnicolo-ribaudo
npm/@babel/preset-flow@7.22.5None+454 kBnicolo-ribaudo
npm/@babel/preset-react@7.18.6None+192.3 kBnicolo-ribaudo
npm/@babel/preset-react@7.23.3None012.3 kBnicolo-ribaudo
npm/@babel/preset-typescript@7.18.6None014.1 kBnicolo-ribaudo
npm/@babel/register@7.21.0environment, filesystem, unsafe+275.9 kBnicolo-ribaudo
npm/@babel/template@7.24.0None068.9 kBnicolo-ribaudo
npm/@babel/traverse@7.1.6environment0144 kBnicolo-ribaudo
npm/@babel/types@7.19.0environment02.5 MBnicolo-ribaudo
npm/@babel/types@7.24.0environment+32.5 MBnicolo-ribaudo
npm/@cspotcode/source-map-support@0.8.1filesystem+1194 kBcspotcode
npm/@eslint-community/regexpp@4.10.0None0431 kBeslint-community-bot
npm/@eslint/eslintrc@3.1.0filesystem, unsafe Transitive: environment+41.41 MBeslintbot
npm/@eslint/js@9.6.0None014.2 kBeslintbot
npm/@hapi/hoek@9.3.0None051.5 kBdevinivy
npm/@heroicons/react@1.0.6None0860 kBbradlc
npm/@humanwhocodes/object-schema@2.0.2None053.3 kBnzakas
npm/@jest/core@28.1.3unsafe Transitive: environment+5362 kBsimenb
npm/@jest/environment@28.1.3None013.2 kBsimenb
npm/@jest/expect@28.1.3None05.15 kBsimenb
npm/@jest/fake-timers@28.1.3None025.2 kBsimenb
npm/@jest/globals@28.1.3None03.32 kBsimenb
npm/@jest/reporters@28.1.3environment, unsafe Transitive: filesystem+15765 kBsimenb
npm/@jest/source-map@28.1.2None+111.4 kBsimenb
npm/@jest/test-sequencer@28.1.3None+116.7 kBsimenb
npm/@jest/transform@28.1.3Transitive: environment, filesystem, shell, unsafe+51.54 MBsimenb
npm/@monaco-editor/loader@1.3.3None+1109 kBsurenat
npm/@monaco-editor/react@4.5.1None0151 kBsurenat
npm/@napi-rs/cli@2.16.3None08.67 MBbroooooklyn
npm/@next/env@13.5.6environment, filesystem06.95 kBvercel-release-bot
npm/@next/eslint-plugin-next@13.5.6filesystem+1136 kBvercel-release-bot
npm/@next/swc-darwin-arm64@13.5.6None0108 MBvercel-release-bot
npm/@next/swc-darwin-x64@13.5.6None0109 MBvercel-release-bot
npm/@next/swc-linux-arm64-gnu@13.5.6None0110 MBvercel-release-bot
npm/@next/swc-linux-arm64-musl@13.5.6None0130 MBvercel-release-bot
npm/@next/swc-linux-x64-gnu@13.5.6None0123 MBvercel-release-bot
npm/@next/swc-linux-x64-musl@13.5.6None0143 MBvercel-release-bot
npm/@next/swc-win32-arm64-msvc@13.5.6None096.7 MBvercel-release-bot
npm/@next/swc-win32-ia32-msvc@13.5.6None089.8 MBvercel-release-bot
npm/@next/swc-win32-x64-msvc@13.5.6None0128 MBvercel-release-bot
npm/@parcel/watcher@2.1.0Transitive: environment, filesystem+22.63 MBdevongovett
npm/@pkgr/utils@2.4.1environment Transitive: filesystem, shell+27592 kBjounqin
npm/@playwright/test@1.41.2Transitive: environment, eval, filesystem, network, shell, unsafe+210.1 MByurys
npm/@playwright/test@1.42.1Transitive: environment, eval, filesystem, network, shell, unsafe+210.1 MByurys
npm/@pmmmwh/react-refresh-webpack-plugin@0.5.7environment, filesystem Transitive: eval+61.4 MBpmmmwh
npm/@rollup/plugin-commonjs@25.0.7filesystem+4727 kBshellscape
npm/@rollup/plugin-json@6.1.0None+2118 kBshellscape
npm/@rollup/plugin-node-resolve@15.2.3filesystem Transitive: unsafe+7247 kBshellscape
npm/@rollup/plugin-terser@0.4.4eval, unsafe Transitive: environment+22.26 MBlukastaegert
npm/@rollup/plugin-typescript@11.1.6environment, filesystem+1185 kBshellscape
npm/@rushstack/eslint-patch@1.5.1None046.5 kBodspnpm
npm/@sinclair/typebox@0.24.42None0303 kBsinclair
npm/@sinonjs/commons@1.8.3None+180.1 kBmrgnrdrck
npm/@sinonjs/fake-timers@9.1.2eval091.6 kBfatso83
npm/@swc/helpers@0.5.2None0228 kBkdy1
npm/@testing-library/dom@8.18.1environment Transitive: eval+32.64 MBtesting-library-bot
npm/@testing-library/react@13.4.0environment04.02 MBtesting-library-bot
npm/@tsconfig/node10@1.0.9None02.39 kBtypescript-deploys
npm/@tsconfig/node12@1.0.11None02.5 kBtypescript-deploys
npm/@tsconfig/node14@1.0.3None02.39 kBtypescript-deploys
npm/@tsconfig/node16@1.0.3None02.39 kBtypescript-deploys
npm/@tsconfig/node18-strictest@1.0.0None03.55 kBtypescript-deploys
npm/@tsconfig/strictest@2.0.5None02.98 kBtypescript-deploys
npm/@types/babel__code-frame@7.0.6None05.94 kBtypes
npm/@types/babel__traverse@7.18.2None0126 kBtypes
npm/@types/babel__traverse@7.20.5None084.1 kBtypes
npm/@types/eslint@8.56.6None0192 kBtypes
npm/@types/estree@1.0.1None025.7 kBtypes
npm/@types/fbt@1.0.4None012.1 kBtypes
npm/@types/glob@8.1.0None+119.2 kBtypes
npm/@types/invariant@2.2.35None04.26 kBtypes
npm/@types/istanbul-lib-coverage@2.0.6None05.45 kBtypes
npm/@types/jest@28.1.8None073.6 kBtypes
npm/@types/jest@29.5.12Transitive: environment, unsafe+18626 kBtypes
npm/@types/jsdom@20.0.0None+135.8 kBtypes
npm/@types/json5@0.0.29None03 kBtypes
npm/@types/node@18.11.9None03.56 MBtypes
npm/@types/node@18.7.19None03.5 MBtypes
npm/@types/node@20.12.11None02.06 MBtypes
npm/@types/prettier@2.7.3None049.8 kBtypes
npm/@types/prettier@3.0.0None01.72 kBtypes
npm/@types/react-dom@18.0.9None028.8 kBtypes
npm/@types/react@18.0.21None+31.38 MBtypes
npm/@types/react@18.0.25None+31.38 MBtypes
npm/@types/semver@7.5.8None023.3 kBtypes
npm/@types/yargs@17.0.13None+1116 kBtypes
npm/@typescript-eslint/eslint-plugin@7.4.0Transitive: environment, filesystem, unsafe+316.43 MBjameshenry
npm/@typescript-eslint/parser@7.15.0Transitive: environment, filesystem, unsafe+162.31 MBjameshenry
npm/@typescript-eslint/scope-manager@7.4.0None+1769 kBjameshenry
npm/@typescript-eslint/types@7.15.0None0160 kBjameshenry
npm/@typescript-eslint/typescript-estree@7.15.0Transitive: environment, filesystem+92.03 MBjameshenry
npm/@typescript-eslint/visitor-keys@7.4.0None+151.6 kBjameshenry
npm/@use-gesture/core@10.2.27environment0349 kBdbismut
npm/@use-gesture/react@10.2.27environment037.7 kBdbismut
npm/acorn@8.11.3None0531 kBmarijn
npm/aria-query@5.0.2None0161 kBjessebeach
npm/array-buffer-byte-length@1.0.0None08.05 kBljharb
npm/array-includes@3.1.6None025 kBljharb
npm/array.prototype.findlastindex@1.2.3Transitive: eval+392.71 MBljharb
npm/array.prototype.flatmap@1.3.1None+128.6 kBljharb
npm/array.prototype.tosorted@1.1.1None+128.1 kBljharb
npm/asynciterator.prototype@1.0.0None07.23 kBljharb
npm/autoprefixer@10.4.14environment+1266 kBai
npm/axe-core@4.7.2None02.35 MBnpmdeque
npm/axobject-query@3.1.1Transitive: eval+19513 kBjessebeach
npm/babel-jest@28.1.3environment Transitive: filesystem, shell+6118 kBsimenb
npm/babel-jest@29.7.0environment Transitive: eval, filesystem, network, shell, unsafe+38764 kBsimenb
npm/babel-plugin-fbt-runtime@1.0.0None09.62 kBkayhadrin
npm/babel-plugin-fbt@1.0.0environment Transitive: filesystem+181.48 MBkayhadrin
npm/babel-plugin-jest-hoist@28.1.3None+364.6 kBsimenb
npm/babel-plugin-syntax-hermes-parser@0.15.1None05.95 kBhermes-team
npm/babel-preset-jest@28.1.3Transitive: eval+18.19 kBsimenb
npm/bs-logger@0.2.6environment, filesystem047.8 kBhuafu
npm/caniuse-lite@1.0.30001581None01.97 MBcaniuse-lite
npm/caniuse-lite@1.0.30001616None02.05 MBcaniuse-lite
npm/ci-info@3.9.0environment026.1 kBsibiraj-s
npm/client-only@0.0.1None0611 Bsebmarkbage
npm/clsx@1.2.1None05.67 kBlukeed
npm/core-js-compat@3.30.2None0662 kBzloirock
npm/create-require@1.1.1filesystem, unsafe06.25 kBpi0
npm/css-loader@6.11.0None+3181 kBevilebottnawi
npm/decimal.js@10.4.1None0283 kBmikemcl
npm/deep-is@0.1.4None08.11 kBthlorenz
npm/deepmerge@4.3.1None031.2 kBtehshrike
npm/define-data-property@1.1.1None+356.6 kBljharb
npm/define-properties@1.1.4None+119.7 kBljharb
npm/electron-to-chromium@1.4.758None0287 kBkilianvalkhof
npm/enhanced-resolve@5.14.1None0187 kBthelarkinn
npm/entities@4.5.0None0413 kBfeedic
npm/es-abstract@1.21.2None+231.95 MBljharb
npm/es-iterator-helpers@1.0.15Transitive: eval+38718 kBljharb
npm/es5-ext@0.10.63eval+3531 kBmedikoo
npm/eslint-config-next@13.5.6unsafe Transitive: environment, eval, filesystem+929.73 MBvercel-release-bot
npm/eslint-module-utils@2.8.0None036.4 kBljharb
npm/eslint-scope@8.0.1None0148 kBeslintbot
npm/eslint-utils@3.0.0None+1383 kBmysticatea
npm/eslint-v7@7.32.0None00 B
npm/eslint-v9@9.0.0None00 B
npm/eslint@8.27.0filesystem Transitive: environment, unsafe+154.35 MBeslintbot
npm/eslint@9.6.0environment Transitive: filesystem, unsafe+173.61 MBeslintbot
npm/espree@10.1.0None+1101 kBeslintbot
npm/fast-glob@3.2.12filesystem091.9 kBmrmlnc
npm/fbt@1.0.0environment+1769 kBkayhadrin
npm/flatted@3.3.1None040.3 kBwebreflection
npm/flow-bin@0.232.0None0153 MBflowtype
npm/flow-remove-types@2.232.0Transitive: unsafe+260.2 kBflowtype
npm/folder-hash@4.0.4filesystem032.5 kBmarcw136
npm/get-intrinsic@1.1.3eval037.1 kBljharb
npm/goober@2.1.13None+11.3 MBcristianbote
npm/grapheme-splitter@1.0.4None0237 kBorling
npm/hermes-eslint@0.14.0Transitive: filesystem+21.5 MBhermes-team
npm/hermes-eslint@0.17.1Transitive: filesystem+21.58 MBhermes-team
npm/hermes-eslint@0.20.1None0264 kBhermes-team
npm/hermes-parser@0.19.2filesystem+11.34 MBhermes-team
npm/hermes-parser@0.20.1filesystem+11.34 MBhermes-team
npm/http-server@14.1.1environment, filesystem, network Transitive: shell+332.18 MBthornjad
npm/internal-slot@1.0.5None+241.2 kBljharb
npm/is-array-buffer@3.0.2None+119.1 kBljharb
npm/is-core-module@2.12.1None029.3 kBljharb
npm/is-date-object@1.0.5None+131.7 kBljharb
npm/is-map@2.0.2None012.7 kBljharb
npm/is-set@2.0.2None012.3 kBljharb
npm/is-typed-array@1.1.10None+356.5 kBljharb
npm/istanbul-lib-coverage@3.2.2None034.4 kBoss-bot
npm/jackspeak@2.3.6environment0253 kBisaacs
npm/jest-changed-files@28.1.3environment Transitive: shell+6139 kBsimenb
npm/jest-circus@28.1.3Transitive: unsafe+6105 kBsimenb
npm/jest-cli@28.1.3None+4308 kBsimenb
npm/jest-config@28.1.3Transitive: environment+5171 kBsimenb
npm/jest-docblock@28.1.1None+112.9 kBsimenb
npm/jest-each@28.1.3None038 kBsimenb
npm/jest-environment-jsdom@29.0.3Transitive: environment, unsafe+13290 kBsimenb
npm/jest-environment-jsdom@29.7.0None+351.4 kBsimenb
npm/jest-environment-node@28.1.3unsafe08.57 kBsimenb
npm/jest-haste-map@28.1.3environment, filesystem, shell, unsafe Transitive: network+5157 kBsimenb
npm/jest-leak-detector@28.1.3unsafe06.53 kBsimenb
npm/jest-mock@28.1.3None042 kBsimenb
npm/jest-resolve-dependencies@28.1.3None08.93 kBsimenb
npm/jest-resolve@28.1.3environment, unsafe+272.4 kBsimenb
npm/jest-runner@28.1.3environment Transitive: filesystem, unsafe+2120 kBsimenb
npm/jest-runtime@28.1.3unsafe Transitive: environment, shell+9354 kBsimenb
npm/jest-snapshot@28.1.3eval+3224 kBsimenb
npm/jest-validate@28.1.3None+139.9 kBsimenb
npm/jest-worker@28.1.3environment, shell069.1 kBsimenb
npm/jest@28.1.3None05.06 kBsimenb
npm/jest@29.7.0Transitive: environment, eval, filesystem, network, shell, unsafe+1576.18 MBsimenb
npm/jiti@1.18.2environment, filesystem, unsafe01.95 MBpi0
npm/js-sdsl@4.4.2None01.1 MByaozilong
npm/jsc-safe-url@0.2.4None06.04 kBmetro-bot
npm/jsdom@20.0.0eval, filesystem, network, shell, unsafe+73.19 MBdomenic
npm/jsdom@22.1.0eval, filesystem, network, shell, unsafe Transitive: environment+185.46 MBdomenic
npm/jsx-ast-utils@3.3.3None0230 kBljharb
npm/lilconfig@2.1.0filesystem016.6 kBantonk52
npm/lz-string@1.5.0None0176 kBpieroxy
npm/mini-css-extract-plugin@2.8.1unsafe+1186 kBevilebottnawi
npm/minipass@7.0.4None0285 kBisaacs
npm/monaco-editor-webpack-plugin@7.1.0filesystem Transitive: environment, eval+12.18 MBvscode-bot
npm/monaco-editor@0.34.1environment, network079.5 MBalexandrudima
npm/monaco-editor@0.50.0environment, network099 MBvscode-bot
npm/nanoid@3.3.7None024.4 kBai
npm/next@13.5.6environment, filesystem, network, shell, unsafe+373.6 MBvercel-release-bot
npm/notistack@3.0.1environment0459 kBiamhosseindhv
npm/object.assign@4.1.4None01.17 MBljharb
npm/object.fromentries@2.0.7None+27394 kBljharb
npm/object.values@1.1.7None+27410 kBljharb
npm/optionator@0.9.3None+2112 kBgkz
npm/parse5@7.1.1None+11.05 MBfeedic
npm/path-scurry@1.10.1filesystem+1987 kBisaacs
npm/postcss-import@15.1.0Transitive: filesystem+135.1 kBryanzim
npm/postcss-js@4.0.1None08.45 kBai
npm/postcss-load-config@4.0.1environment, unsafe+1683 kBai
npm/postcss-nested@6.0.1None+1200 kBai
npm/postcss@8.4.39environment, filesystem0198 kBai
npm/prettier@2.8.8environment, filesystem, unsafe011.2 MBprettier-bot
npm/prettier@3.0.3environment, filesystem, unsafe08.49 MBprettier-bot
npm/prettier@3.2.5environment, filesystem, unsafe08.39 MBprettier-bot
npm/pretty-format@29.7.0Transitive: environment+3533 kBsimenb
npm/pure-rand@6.0.2None070.7 kBndubien
npm/re-resizable@6.9.16None097.2 kBbokuweb
npm/react-17@17.0.2None00 B
npm/react-art@19.0.0-rc-fb9a90fa48-20240614environment0855 kBreact-bot
npm/react-compiler-runtime@0.0.0None0218 Bsugarpirate
npm/react-dom-17@17.0.2None00 B
npm/react-dom@0.0.0-experimental-b9be4537c-20230905environment+18.78 MBreact-bot
npm/react-dom@19.0.0-beta-b498834eab-20240506environment+17.51 MBreact-bot
npm/react-dom@19.0.0-rc-fb9a90fa48-20240614environment06.23 MBreact-bot
npm/react-is@19.0.0-beta-b498834eab-20240506environment015.1 kBreact-bot
npm/react-test-renderer@19.0.0-rc-fb9a90fa48-20240614environment+1857 kBreact-bot
npm/react-virtualized-auto-sizer@1.0.23Transitive: environment+13.03 MBbrianvaughn
npm/react-window@1.8.10environment0896 kBbrianvaughn
npm/react@0.0.0-experimental-b9be4537c-20230905environment0452 kBreact-bot
npm/react@19.0.0-beta-b498834eab-20240506environment0379 kBreact-bot
npm/react@19.0.0-rc-fb9a90fa48-20240614environment0240 kBreact-bot
npm/readline@1.3.0filesystem01.96 MBcraigbrookes
npm/regexp.prototype.flags@1.5.0None+147.8 kBljharb
npm/resolve@1.22.2environment, filesystem+2158 kBljharb
npm/rollup-plugin-banner2@1.2.3None+2412 kBstropho
npm/rollup-plugin-prettier@4.1.1None+5756 kBmickael.jeanroy
npm/rollup@4.13.2environment, filesystem+1542.9 MBlukastaegert
npm/rrweb-cssom@0.6.0None052.1 kBfitz5264
npm/scheduler@0.25.0-rc-fb9a90fa48-20240614environment084.2 kBreact-bot
npm/set-function-name@2.0.1None+119.5 kBljharb
npm/shelljs@0.8.5environment, filesystem+1227 kBnfischer
npm/source-map-js@1.2.0None0140 kB7rulnik
npm/sucrase@3.32.0None+21.19 MBalangpierce
npm/tailwindcss@3.3.2environment, filesystem+35.64 MBadamwathan
npm/tough-cookie@4.1.4None+3641 kBccasey
npm/ts-jest@28.0.8environment, filesystem, unsafe0263 kBkul
npm/ts-jest@29.1.5environment, filesystem, unsafe Transitive: network, shell+19825 kBkul
npm/ts-node@10.9.2environment, filesystem, unsafe+41.16 MBblakeembrey
npm/typescript@5.4.3None032.4 MBtypescript-bot
npm/undici@5.28.4environment, network, unsafe+11.25 MBmatteo.collina
npm/update-browserslist-db@1.0.15environment014.3 kBai
npm/w3c-xmlserializer@3.0.0None+131.5 kBdomenic
npm/wait-on@7.2.0filesystem, network Transitive: environment+82.8 MBjeffbski
npm/webpack-dev-middleware@5.3.4filesystem Transitive: eval, unsafe+41.18 MBevilebottnawi
npm/which-typed-array@1.1.9None+370.1 kBljharb
npm/ws@8.17.0environment, network0141 kBlpinca
npm/ws@8.9.0environment, network0135 kBlpinca
npm/zod-validation-error@2.1.0None030.1 kBjmike
npm/zod-validation-error@3.3.0None063.8 kBjmike
npm/zod@3.23.8None0667 kBcolinmcd94

🚮 Removed packages:npm/@actuallyworks/node-fetch@2.6.0, npm/@babel/compat-data@7.20.14, npm/@babel/helper-plugin-utils@7.13.0, npm/@babel/helper-validator-identifier@7.14.0, npm/@babel/highlight@7.14.0, npm/@jest/schemas@29.4.2, npm/@jest/types@29.4.2, npm/@jridgewell/trace-mapping@0.3.17, npm/@pmmmwh/react-refresh-webpack-plugin@0.5.11, npm/@types/node@12.7.1, npm/bn.js@5.2.0, npm/browserslist@4.21.5, npm/caniuse-lite@1.0.30001450, npm/coveralls@3.0.9, npm/devtools-ignore-webpack-plugin@0.1.1, npm/electron-to-chromium@1.4.284, npm/eslint-plugin-flowtype@2.50.3, npm/flow-bin@0.215.0, npm/flow-remove-types@2.215.0, npm/follow-redirects@1.7.0, npm/hermes-eslint@0.15.1, npm/jest-cli@29.4.2, npm/jest-diff@29.4.2, npm/jest-environment-jsdom@29.4.2, npm/jest-get-type@29.4.2, npm/jest-matcher-utils@29.4.2, npm/jest@29.4.2, npm/js-yaml@3.14.0, npm/lodash@4.17.19, npm/mime-db@1.40.0, npm/mime-types@2.1.24, npm/node-releases@2.0.9, npm/prettier@2.8.3, npm/psl@1.3.0, npm/react-dom@0.0.0-experimental-018c58c9c-20230601, npm/react-dom@18.0.0-alpha-7ec4c5597, npm/react-shallow-renderer@16.15.0, npm/react-test-renderer@18.3.1, npm/react-virtualized-auto-sizer@1.0.6, npm/react@0.0.0-experimental-018c58c9c-20230601, npm/react@18.0.0-alpha-7ec4c5597, npm/rollup-plugin-prettier@3.0.0, npm/webpack-dev-middleware@5.3.3, npm/ws@8.12.0

View full report↗︎

@socket-security

Copy link
Copy Markdown

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

AlertPackageNoteSourceCI
Native code npm/@parcel/watcher@2.1.0 🚫
Telemetry npm/next@13.5.6
  • Note: Can be disabled by setting the environment variable NEXT_TELEMETRY_DISABLED=1 . See https://nextjs.org/telemetry for more information
🚫
AI warning npm/next@13.5.6
  • Notes: This code has a worrying combination of potential security risks, including executing a downloaded binary with user input, writing to user-controlled file paths, and automatically modifying the .gitignore. While it does not appear to be outright malware, using it as-is poses significant security concerns. A thorough security review and hardening of these risk areas would be recommended before use.
  • Confidence: 1.00
  • Severity: 0.60
🚫
Install scripts npm/es5-ext@0.10.63
  • Install script:postinstall
  • Source: node -e "try{require('./_postinstall')}catch(e){}"
🚫

View full report↗︎

Next steps

What's wrong with native code?

Contains native code which could be a vector to obscure malicious code, and generally decrease the likelihood of reproducible or reliable installs.

Ensure that native code bindings are expected. Consumers may consider pure JS and functionally similar alternatives to avoid the challenges and risks associated with native code bindings.

What is telemetry?

This package contains telemetry which tracks how it is used.

Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked.

What is an AI detected anomaly?

AI has identified unusual behaviors that may pose a security risk.

An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore npm/@parcel/watcher@2.1.0
  • @SocketSecurity ignore npm/next@13.5.6
  • @SocketSecurity ignore npm/es5-ext@0.10.63

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

20 participants

@markerikson@bvaughn@rickhanlonii@himself65@eps1lon@javache@kassens@poteto@gsathya@jupapios@gnoff@josephsavona@yungsters@jackpope@motiz88@bigfootjon@pieterv@sebmarkbage@hoxyq@jenseng