April 2024 Summaries

Expo-quick-actions is a module that allows developers to implement quick actions and app shortcuts in their Expo apps without writing native code. By using the Expo Modules API, the module provides a cross-platform interface to the iOS Quick Actions and Android App Shortcuts APIs, enabling developers to add features such as custom menu options accessible via long-press on an app icon. This can be particularly useful for engaging users at critical moments, such as when they are about to delete an app. The module relies on native modules and config plugins to facilitate integration, allowing for automatic linking of native code and customization of native project files. Developers can use this functionality to create dynamic and static quick actions, set custom icons, and route users to specific app pages, enhancing user experience and potentially reducing app churn by offering support or feedback options. The guide provides detailed instructions on setting up and using expo-quick-actions, including configuring adaptive icons for Android and leveraging the Expo Router for navigation.

The Expo push notification service uses receipts with unique IDs to confirm whether notifications were correctly received by underlying providers like APNs and FCM, or if there was an error. Traditionally, these receipt IDs were UUIDv4 strings, but starting April 8, there will be an experimental switch to UUIDv7 strings. This change is not expected to impact code that treats receipt IDs as opaque strings, but developers are being notified to avoid relying on undocumented details, such as assuming receipt IDs will always be UUIDv4 or even a UUID, with the only assurance being that they will remain as strings.

A remote code execution vulnerability in EAS Submit, linked to the Fastlane program, was reported by Xavier Bruni, prompting swift action to fix the issue. The vulnerability arose from Fastlane's failure to escape certain inputs before executing shell commands, potentially allowing unauthorized access to data across shared virtual machines (VMs) during iOS app submissions. Upon discovery, the iOS submission service was temporarily disabled, a hotfix was deployed, and additional input validations were added. To prevent future risks, EAS Submit transitioned to using individual ephemeral VMs for each submission job, ensuring enhanced isolation and security. Although no evidence of exploitation was found, users are advised to update their ASC API keys as a precaution.