Repository navigation
fix(mobile): update Capacitor to 8.5.3 - #564
Merged
Merged
Conversation
Capacitor 8.0.0 to 8.3.4 lets a link inside the app load remote content at the app origin through the internal HTTP proxy path (GHSA-rvm3-566m-v7fv). That range has no patch release. Update @capacitor/core, cli, android and ios to 8.5.3, and the core version in the generated native workspace.
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Capacitor 8.0.0 to 8.3.4 has a critical advisory, GHSA-rvm3-566m-v7fv (Dependabot alerts #483 and #484). A link inside the app to the internal path
/_capacitor_http_interceptor_makes the native layer fetch a remote URL and run the response at the app origin.The Android and iOS builds of
workplace,booking-panelandcontroluse Capacitor 8.2.0. Workplace and Booking Panel show calendar event bodies as HTML, and an external sender controls that content. The 8.0.0 to 8.3.4 range has no patch release, so Dependabot cannot open a fix.Solution
@capacitor/core,@capacitor/cli,@capacitor/androidand@capacitor/iosfrom 8.2.0 to 8.5.3.@capacitor/coreversion thattools/capacitor/prepare.mjswrites to the generated native workspace.The web builds do not change. Installed apps stay vulnerable until they are rebuilt and redistributed.
Verification
nx run workplace:"mobile:sync:android"passes and the Android project resolves Capacitor 8.5.3.workplacepasses with Capacitor 8.5.3 when the generated project targets iOS 17 (see the note below).nx test commonpasses.Not verified: an Android APK build (no Android SDK on the machine) and the sign-in deep link on a device.
Note: the iOS build is already broken on
developnx run workplace:"mobile:build:ios"fails ondevelopwith Capacitor 8.2.0 and on this branch with the same error:@capgo/capacitor-intune8.1.2 needs iOS 17 and the generated project targets iOS 15. This pull request does not change that. The iOS apps cannot ship this fix until the target is raised to iOS 17 or the plugin changes.Changes made by Claude Opus 5.5 in T3 Code, through the Claude Code harness.
🤖 Generated with Claude Code