Refreshed Sidebar Navigation in Dashboard

Oct 26, 2023 by

Tomasz Czajecki

We released a new version of our dashboard's sidebar. You can access your accounts and projects from there, as well as the user menu, now located at the bottom of the sidebar (previously in the top right corner of the page).

Fix for CVE-2023-4863 in expo-image@1.3.4

Sep 29, 2023 by

Brent Vatne

expo-image@1.3.4 for SDK 49 has been released with a fix for CVE-2023-4863 — a vulnerability in libwebp that impacted Chrome and many other applications that used the library for WebP decoding. This vulnerability was fixed in libwebp@1.3.2, which was released on September 13, 2023.

The following explains how to apply the fix on each Expo-supported platform, along with context on what changed.

Update expo-image: run npx expo install expo-image on SDK 49, verify that expo-image@1.3.4 or greater is installed, and deploy a new native build. If you are still using SDK 48, ensure that you are using expo-image@1.0.2 or greater.

Any build that used expo-image@1.3.3 or earlier (and therefore libweb@1.3.1 or earlier) is affected.

In expo-image@1.3.4, we removed GlideWebpDecoder, which (at the time of writing) depends on an outdated libwebp version. This dependency was responsible for animated WebP decoding in expo-image. We now use APNG4Android instead, which was already included for supporting other animated image formats. If you notice any regressions in animated WebP support in your application, file a bug report on expo/expo.

Ensure that you are using libwebp 1.3.2 or greater:

If you use CNG, the new version of libwebp will be installed automatically when you generate your iOS project with npx expo prebuild --clean (or on EAS Build).

If you manage your own iOS project, you can verify in ios/Podfile.lock that you are using libwebp@1.3.2, and run pod update libwebp in your ios directory if not.

If you use EAS Build, look in your "Install pods" logs for your build on EAS Build, and find the libwebp line. If you see Installing libwebp (1.3.1) (or any other earlier version), then it is affected.

Alternatively, on the commit where you created your last build, check the Podfile.lock in your ios directory for libwebp. If you are using 1.3.1 or earlier, then it is affected.

libwebp@1.3.2, released on September 13, 2023, matches the version constraint specified by SDWebImageWebPCoder (~> 1.0), so any new installs in the last ~2 weeks will have automatically picked this up.

No changes are required on your part, libwebp is part of Chrome.

If you support platforms beyond those listed above, be sure to check with the related frameworks that you use to see if they are affected.

Xcode 15 and iOS 17

Sep 28, 2023 by

Brent Vatne

Xcode 15 and iOS 17 were released on Monday, September 18th. Since then, we've released the following improvements to our tools and services in order to fully support these new versions.

Use Xcode 15 on EAS Build by setting the ios.image field on your build profile to macos-ventura-13.6-xcode-15.0. Alternatively, use the alias that currently points to it: latest. Learn more.

The default Xcode version for currently released SDK versions (Xcode 14.3 for SDK 49) will remain unchanged in order to ensure a reliable and consistent build experience.

eas.json

{
  "build": {
    "production": {
      "ios": {
        "image": "latest"
      }
    }
  }
}

React Native 0.72.5 is now recommended for SDK 49 (the previously recommended version was 0.72.4). This patch release includes support for Xcode 15. If you are using SDK 49, we recommend upgrading to this version if you build locally and have Xcode 15 installed, or if you would like to use Xcode 15 on EAS Build. You can install it with npx expo install --fix.

Note: We will be updating the recommended React Native patch version for SDK 47 and 48 when new versions are released with support for Xcode 15.

EAS Build will automatically sync the newly added "Tap to Pay on iPhone" (com.apple.developer.proximity-reader.payment.acceptance) capability when the entitlement is set in your app config under ios.entitlements. Note that you must request access to this entitlement from Apple in order to use it.

Install the latest version with npx expo install expo-calendar and re-build your app with Xcode 15. The improvements are availabile in expo-calendar@~1.3.2. We recommend updating if you use expo-calendar in your app. The following is a technical outline of the changes to the calendar API that were made in order to support iOS 17.

• iOS 17 introduces a new permissions model in EventKit. Previously, you could request access and you would be either granted full access or none at all. In iOS 17 this has been changed. You can now request (1) write-only access, (2) full-access, or (3) present the new EventKitEditViewController, which requires no user permissions.
• This change means all apps linked against iOS 17 must adopt this new model now — all uses of the older APIs on iOS 17 will fail. We have implemented the necessary changes in expo-calendar in expo/expo#24545
• The method requestAccess(to:) has been replaced with two new APIs that must be used in iOS 17: requestFullAccessToReminders and requestFullAccessToEvents. Calling the requestAccess(to:) API on iOS 17 is now a no-op. We have added support for both of the new APIs in expo-calendar.
• This change also required two new keys to be added to the Info.plist. NSRemindersFullAccessUsageDescription and NSCalendarsFullAccessUsageDescription. Changes were made to the config plugin to support this and provide defaults for both of these properties.
• The current solution will build on both Xcode 14 and 15, but for the devices running iOS 17, the app will need to have been built with Xcode 15.
• The fix we have in place maintains the previous behavior. We will be evaluating the new changes and adding support for presenting EventKitEditViewController and requesting write-only access, likely coming in SDK 50.

Support for Bun in EAS and Expo CLI

Sep 25, 2023 by

Kadi Kraman

We have added support for Bun on Expo CLI and EAS! This means you can use Bun to create your Expo app, install packages, run scripts and build your app on EAS.

The first step (if you haven't yet) is to install Bun on your local machine. After installation, you should have access to bun in your terminal.

To create a new Expo app:

bun create expo my-app

Run a package.json script:

bun run ios

Install a package:

bun expo install expo-av

You can also use Bun to install packages, but output a readable yarn.lock as well as the bun.lockb:

bun install --yarn

EAS will decide which packager to use based the lockfile in your codebase. So if you want EAS to use Bun, run bun install in your codebase and ensure it creates a bun.lockb - the Bun lockfile. As long as this lockfile is in your codebase, Bun will be used as the package manager for your builds.

EAS will use bun@1.0.2 by default. If you want or need to use a particular version of Bun, you can configure the exact version in each build in your eas.json.

eas.json

{
  "build": {
    "test": {
      "bun": "1.0.0"
      // other settings...
    }
    // other build profiles...
  }
}

You have a new notification! You can now see the latest updates from your personal and organization accounts in the new website notification center.

You can visit the notification center by clicking the bell icon in the navigation bar. Currently only build limit threshold notifications are supported but more types of notifications will be added in the future.