Skip to content

feat(device-utils): iOS cold-start local notification deep-link support (OK-55681)#61

Open
huhuanming wants to merge 7 commits into
mainfrom
fix/ios-coldstart-local-notification-deeplink
Open

feat(device-utils): iOS cold-start local notification deep-link support (OK-55681)#61
huhuanming wants to merge 7 commits into
mainfrom
fix/ios-coldstart-local-notification-deeplink

Conversation

@huhuanming

Copy link
Copy Markdown
Contributor

Summary

This PR introduces iOS cold-start local notification deep-link support via a new
API in the
module.

Changes

  • feat(device-utils): Add method to
    retrieve and clear the cold-start local notification payload on iOS (OK-55681)
  • chore: Bump all package versions to 3.0.55

Checklist

  • Version bumped to 3.0.55
  • CI package-publish completed successfully

Please review. 🙏

… cold-start deep-link (OK-55681)

LaunchOptionsStore gains an in-memory coldStartLocalNotification slot
(JSON userInfo of a tapped LOCAL notification) plus a read-once
takeColdStartLocalNotification(). The new Nitro method
getAndClearColdStartLocalNotification() returns it and clears it; the host
AppDelegate writes the slot via KVC on a killed-app notification tap.

In-memory only (no NSUserDefaults): a new process = fresh nil, so it is
launch-scoped and cannot replay a stale tap. Android returns "" (taps
arrive via Intent extras there). Run yarn nitrogen + yarn prepare before
publishing 3.0.54.
@socket-security

socket-security Bot commented Jun 9, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Critical
Critical CVE: npm shell-quote quote() does not escape newlines in object .op values

CVE: GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values (CRITICAL)

Affected versions: >= 1.1.0 < 1.8.4

Patched version: 1.8.4

From: ?npm/react-native@0.83.0npm/shell-quote@1.8.3

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/shell-quote@1.8.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm react-native is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: example/react-native/package.jsonnpm/react-native@0.83.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-native@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm string-width is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/release-it@19.1.0npm/string-width@8.1.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/string-width@8.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

- iOS/Android: warm-boot the shared offline page + route page->native
  callbacks to owner ?? warmDriver so bars-state/load-end aren't dropped
  while the host that owns the WebView is the offscreen prewarm
- source/bridge setters apply synchronously (drop scheduleReconcile, which
  caused an infinite reconcile loop on Android)
- add ChartWV diagnostics via OneKeyLog (depend on ReactNativeNativeLogger)
- fix Android compileReleaseKotlin: dispose() needs override
…retries

- Android: pause the pooled WebView's renderer (onPause) when no host owns it and
  resume on claim — Android (unlike iOS WKWebView) never throttles an offscreen
  WebView, so the warm page burned a CPU core + grew RAM to OOM after leaving the
  chart. Per-instance onPause (NOT process-global pauseTimers).
- attachToContainer: retry reparent up to 12 frames instead of giving up after 1
  (a single retry stranded the WebView in the old container -> blank chart slot)
- webviewDebuggingEnabled Nitro prop (iOS isInspectable / Android
  setWebContentsDebuggingEnabled) following the dev-mode toggle (Agent B)
…roid re-entry white-screen/stuck-loading)

Pooled WebView re-parented across hosts left a stale parent on dispose, so
re-entering a chart showed a white screen / infinite loading (issues 1 & 2).
- forceDetach(): endViewTransition + removeView, fallback removeViewInLayout +
  requestLayout, so the parent is cleared synchronously even on a dead container.
- detachFrom(): parent-checked, used by ChartWebview.dispose() for pooled hosts.
- attachToContainer(): uses forceDetach, retries via container.post.

Retains ChartDBG diagnostic counters (warmDriver/owner setters, throttled
per-3s msgIn/native->page RATE, pauseIfIdle SKIP/PAUSE/RESUME) for ongoing
on-device verification; to be removed before merge.
…ve logs

Remove the ChartDBG diagnostic layer added for the Android root-cause work:
- DBG tag, owner/warmDriver transition logs, dbgId getter
- throttled msgIn/native->page rate counters + rateLogger handler
- pauseIfIdle SKIP verbose log

Keep only operational logs under the ChartWebviewPool tag: WebView
CREATED/DESTROYED (singleton verification), renderer PAUSE/RESUME, and the
attach-failed-after-retries warning. Logging-only change; behavior unchanged.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant