Security: Update dev dependencies and fix npm packaging #353
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Address security assessment findings by updating dev tooling: - Add "files" field to package.json to whitelist only SDK code (34 files) - Update uuid from 3.3.2 to ^9.0.1 with new named import pattern - Update devDependencies: react-native 0.63→0.76, jest 26→29, babel 7.12→7.26 - Remove outdated sample apps (ContextAPIMixpanel, MixpanelDemo) using RN 0.64 - Add babel.config.js for Jest compatibility with modern RN - Fix test mocks to return promises for async native module methods npm audit now reports 0 vulnerabilities. Package size reduced from 150+ files to 34 files (35.2 kB). All 119 tests pass across 7 test suites.
There was a problem hiding this comment.
Pull request overview
This PR addresses security vulnerabilities by updating dev dependencies and optimizing the npm package by adding a files whitelist. The core changes include upgrading uuid from 3.3.2 to ^9.0.1 with the appropriate named import pattern, updating dev tooling (React Native 0.63→0.76, Jest 26→29, Babel 7.12→7.26), and removing two outdated sample apps.
Changes:
- Updated uuid dependency from 3.3.2 to ^9.0.1 with named import pattern (
import { v4 as uuidv4 }) - Added
filesfield to package.json to whitelist only SDK code (34 files, 35.2 kB) - Updated devDependencies to modern versions and fixed test mocks for async methods
- Removed MixpanelDemo and ContextAPIMixpanel sample apps (both using outdated RN 0.64.4)
Reviewed changes
Copilot reviewed 109 out of 137 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| package.json | Added files whitelist, updated uuid to ^9.0.1, modernized dev dependencies, updated Jest config |
| javascript/mixpanel-persistent.js | Changed uuid import from default to named export pattern |
| babel.config.js | Added Babel config for Jest 29 compatibility |
| tests/persistent.test.js | Simplified UUID mocking tests, updated for uuid v9 |
| tests/main.test.js | Removed unused react-native imports |
| tests/jest_setup.js | Fixed mocks to return promises for async methods |
| Samples/MixpanelDemo/* | Removed entire outdated sample app |
| Samples/ContextAPIMixpanel/* | Removed entire outdated sample app |
Files not reviewed (2)
- Samples/ContextAPIMixpanel/ios/ContextAPIMixpanel.xcworkspace/contents.xcworkspacedata: Language not supported
- Samples/MixpanelDemo/ios/MixpanelDemo.xcworkspace/contents.xcworkspacedata: Language not supported
- Add backward compatibility test for loading existing device IDs - Add README.md, LICENSE.md, CHANGELOG.md to package.json files field - Remove redundant android/*.gradle pattern from files field - Fix missing await in initializationCompletePromise (pre-existing bug) - Document pre-existing error handling issues for follow-up PR
Collaborator
Author
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. 🤖 Generated with Claude Code |
Contributor
|
A quick note on commons-collections and htmlunit. These are found as a sub-dependency of selendroid under the /acceptance directory. Are we able to delete this? It is no longer maintained and shouldn't be used. |
scotmatson
approved these changes
Jan 16, 2026
SimpleMixpanel provided minimal value over MixpanelExample and MixpanelStarter. MixpanelExample covers the same basic use case with proper initialization patterns, while MixpanelStarter provides production-ready architecture. This reduces maintenance burden as part of the security cleanup effort.
Matches MixpanelStarter pattern for reproducible iOS builds.
- Upgrade React to 19.1.0 and React Native to 0.81.5 - Enable new architecture (newArchEnabled: true) - Update react-native-web to 0.20.0 - Fix SDK reference to use file:../.. instead of .yalc
jaredmixpanel
added
enhancement
jaredmixpanel
deleted the
security/update-dev-dependencies-and-npm-packaging
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
"files"field to package.json to whitelist only SDK code (34 files, 35.2 kB)Context
A customer security scan flagged vulnerabilities in dev dependencies and sample apps. While these don't affect SDK users (they're not shipped), this PR cleans them up to satisfy security requirements.
Results
Changes
Core SDK:
filesfield, updated dependenciesSample Apps:
ContextAPIMixpanel,MixpanelDemo,SimpleMixpanel(outdated RN 0.64)MixpanelExpoto React Native 0.81 with new architecture enabledPodfile.lockandxcworkspaceforMixpanelExample(reproducible iOS builds)CI & Docs:
MixpanelExampleinstead of deletedSimpleMixpanel.github/copilot-instructions.mdto reflect current sample appsRemaining Sample Apps
MixpanelExample- Core integration patterns (used in CI)MixpanelExpo- Expo project with full API referenceMixpanelStarter- Production-ready architecture with TypeScriptTest plan
npm test- all 119 tests pass across 7 suitesnpm audit- 0 vulnerabilitiesnpm pack --dry-run- verify only 34 SDK files included