[jasperhuangg]

Explanation of Change

• Bumps async from 2.6.3 to 2.6.4 in the example app's lockfile. This fixes the prototype pollution advisory (GHSA-fwr7-v2mv-hh25, Dependabot alert 32).
• The change is only the async entry in example/yarn.lock. No other packages move.
• async only reaches the example app's dev tooling: React Native CLI → Metro → async. The published library has no dependencies and its package excludes example/ (.npmignore), so nothing changes for apps that install react-native-share-menu.

Fixed Issues

$ https://github.com/Expensify/Expensify/issues/701874

This supersedes #180, which can't be updated because master has unsigned commits that the signature rule rejects.

Tests

Before you start: on Node 17 or newer, run export NODE_OPTIONS=--openssl-legacy-provider in every terminal you use below. Without it, React Native 0.63's Metro answers every bundle request with a 500 (error:0308010C:digital envelope routines::unsupported), and the app shows a red screen. This also happens on master. Metro may also print Watchman crawl failed. Retrying once with node crawler with path "." must be absolute. That comes from watchFolders in example/metro.config.js, is the same on master, and is safe to ignore.

Metro and the CLI (no simulator needed)

1. In example/, run yarn install --frozen-lockfile.
   • Expected: it finishes without errors, and git status shows no change to yarn.lock.
2. Run node -p "require('async/package.json').version".
   • Expected: it prints 2.6.4.
3. Run yarn start.
   • Expected: Metro shows the "Welcome to React Native!" banner and waits for connections.
4. In a second terminal in example/, run curl -s -o /dev/null -w '%{http_code}\n' 'http://localhost:8081/index.bundle?platform=ios&dev=true'.
   • Expected: it prints 200. This is the main app bundle.
5. Run curl -s -o /dev/null -w '%{http_code}\n' 'http://localhost:8081/index.share.bundle?platform=ios&dev=true'.
   • Expected: it prints 200. This is the bundle the iOS share extension loads.
6. Run curl -s -o /dev/null -w '%{http_code}\n' 'http://localhost:8081/index.bundle?platform=android&dev=true'.
   • Expected: it prints 200.
7. In example/App.js, change the React Native Share Menu title text to Share Menu Test and save. Then run curl -s 'http://localhost:8081/index.bundle?platform=ios&dev=true' | grep -c 'Share Menu Test'.
   • Expected: it prints 1. Metro picked up the edit without a restart. Undo the change and save.

Android app (keep Metro from step 3 running)

8. With an Android emulator running, run yarn android from example/.
   • Expected: the app (example in the launcher) opens and shows the "React Native Share Menu" title, with no red error screen.
9. Repeat the edit from step 7 and save.
   • Expected: the title on the emulator changes to Share Menu Test without restarting the app. Undo the change and save.
10. In Chrome on the emulator, select some text, tap Share, and pick example.
    • Expected: the app opens and shows Shared type: text/plain and Shared text: followed by the selected text.
11. In Google Photos (or Files), share an image and pick example.
    • Expected: the app shows Shared type: image/... and displays the image.

iOS app (optional: needs an Xcode that can still build React Native 0.63; on Xcode 27, pod install fails building Flipper-Glog, on master too)

12. In example/ios, run pod install. Then, from example/, run yarn ios.
    • Expected: the app (Test on the home screen) opens in the simulator and shows the "React Native Share Menu" title, with no red error screen.
13. Repeat the edit from step 7 and save.
    • Expected: the title on the simulator changes to Share Menu Test without restarting the app. Undo the change and save.
14. In Safari on the simulator, select some text, tap Share..., and pick ShareExtension. If it isn't listed, tap More and turn it on.
    • Expected: the share extension opens and shows the selected text, with Dismiss, Send, Dismiss with Error, Continue In App, and Continue In App With Extra Data.
15. Tap Continue In App.
    • Expected: the Test app opens and shows Shared type: text/plain and Shared text: followed by the selected text.
16. In Photos, open any photo, tap Share, pick ShareExtension, then tap Continue In App With Extra Data.
    • Expected: the extension shows the image first. The app then shows Shared type: image/..., displays the image, and shows Extra data: {"hello":"from the other side"}.

Automated checks already run on this branch (not manual tests): frozen-lockfile install and yarn check --integrity pass, a prototype-pollution check fails on async 2.6.3 and passes on 2.6.4, and Metro builds iOS bundles for both index.js and index.share.js.

QA

1. No QA needed beyond the Tests above. This only changes the example app's dev tooling lockfile. Nothing ships in the published react-native-share-menu package.

[jasperhuangg]

(Jasper's Agent)

• Lockfile-only bump. The integrity/sha1 match the registry, 2.6.4 satisfies ^2.4.0, and the link:.. entry is identical to master.
• The only path is react-native → cli 4.10.1 → metro 0.58.0 → async. Nothing actually requires it: Metro didn't load it while building both bundles or serving them from the dev server.
• The published package (no deps, .npmignore drops example) and Expensify/App (dropped this lib in 2021) are unaffected.
• Covers Dependabot alert 32, the only open async alert. Supersedes #180.
• Fixed the Explanation's bare "#32" so it links to the alert instead of PR 32.
• Updated Tests: Node 17+ needs --openssl-legacy-provider, added simulator-free Metro curl checks, corrected the app/share-sheet labels, and marked iOS optional since pod install fails on Xcode 27 (unrelated to this PR).