Hermes Framework Version Metadata Inconsistency

[unstoo]

Hermes Framework Version Metadata Inconsistency

Summary

The Hermes framework's version metadata (Info.plist and binary version) doesn't reflect the actual codebase version when built, causing issues with security scanning tools. The version numbers defined in build files (0.12.0) don't match the actual codebase version (0.13.0).

Discovery Context

This issue was identified during a security audit of a React Native mobile application. Looking at Snyk's vulnerability database for Hermes, we can see multiple vulnerabilities that are version-dependent, making accurate version reporting crucial for security assessment.

Investigation Steps Taken

1. Initial Observation:

   • Snyk's vulnerability database shows multiple vulnerabilities for Hermes with specific version ranges
   • Many vulnerabilities are marked as affecting versions up to specific releases (e.g., [,0.12.0])

2. Local Version Verification:

   # Checked iOS framework metadata
   cat ios/Pods/hermes-engine/destroot/Library/Frameworks/universal/hermes.xcframework/ios-arm64/hermes.framework/Info.plist
   
   # Output showed:
   <key>CFBundleShortVersionString</key>
   <string>0.12.0</string>

3. Binary Version Check:

   otool -L ios/Pods/hermes-engine/destroot/Library/Frameworks/universal/hermes.xcframework/ios-arm64/hermes.framework/hermes
   
   # Output showed:
   @rpath/hermes.framework/hermes (compatibility version 0.12.0, current version 0.12.0)
   

4. Version numbers are defined in multiple Hermes build files:

   • CMakeLists.txt
   • android/build.gradle
   • hermes-engine.podspec
   • npm/package.json

Impact

The issue creates unnecessary overhead across security, development, and compliance processes, requiring manual intervention for what should be an automated verification process.

Environment

• React Native: 0.75.5
• React: 18.3.1
• Platform: iOS
• Development OS: macOS 15.3.1

[tmikov]

Hi, at this time Hermes does not have independent releases, it is automatically compiled and bundled from the current main branch by React Native when they cut a release. In this sense the versions encoded in Hermes (0.12 or 0.13) are not very useful and are a remnant of a previous development model which is no longer active.

I will transfer this issue to React Native, since at the moment they are responsible for the releases and might have ideas how to address this.

[react-native-bot]

Warning

Missing reproducer: We could not detect a reproducible example in your issue report. Please provide either:

• If your bug is UI related: a Snack
• If your bug is build/upgrade related: a project using our Reproducer Template
• Otherwise send us a Pull Request with the RNTesterPlayground.js edited to reproduce your bug.