The Wire · Showcase
React Native cuts FileIoHandler security risk
By RepoJournal · Filed · About Meta
React Native patches a serious security hole and stabilizes its Android E2E pipeline in one busy day.
React Native shipped a high-priority fix by removing the FileIoHandler packager handler, which "is a major security risk if left unguarded in production" and was never ported to iOS [1]. In the same release, RuntimeScheduler now clears its queues on error by default, ending an experiment that prevents queued work from executing after a task throws [2]. The SwiftPM manifest naming collision fix resolves a class of cryptic duplicate-name errors that broke builds for packages like powersync/react-native [3]. On the CI front, React's pipeline is getting faster, with eps1lon moving build artifact downloads and Java setup into background steps to overlap network and CPU work [4][5]. A follow-up pins build shard weights per run to keep worker assignments identical, avoiding flaky bundle builds [6]. React Native also stabilized its Android E2E tests for ARM64 APKs, updating screenshot baselines and limiting certain FlatList flows to release builds [7]. Finally, a maintenance PR refreshes all Jest lock files [8]. This is the upgrade you've been waiting for: patch your dev servers before anyone exploits that handler.
One email a day. Unsubscribe in one click.
Keep up with Meta in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Upgrade React Native to a version that includes the FileIoHandler removal before next deploy facebook/react-native [immediate]
- → Adopt the RuntimeScheduler queue-clearing default in your test runs facebook/react-native [plan]
- → Monitor the SwiftPM collision fix if you depend on scoped npm packages facebook/react-native [plan]
- → Review the background artifact download and shard pinning changes in React's CI facebook/react [monitor]
References
- [1] Remove FileIoHandler (#58096) facebook/react-native
- [2] Enable RuntimeScheduler queue clearing on error by default (#58129) facebook/react-native
- [3] Resolve SwiftPM manifest naming collisions (#58044) facebook/react-native
- [4] [ci] Download build artifacts in the background during job setup ↗ facebook/react
- [5] [ci] Run Java setup in the background during build job setup ↗ facebook/react
- [6] [ci] Pin build shard weights per run to keep worker assignments identical ↗ facebook/react
- [7] Stabilize Android E2E tests for ARM64 APKs (#58140) facebook/react-native
- [8] chore(deps): lock file maintenance ↗ facebook/jest