mirror of
https://github.com/facebook/react-native.git
synced 2025-11-01 09:14:26 +00:00
Nicola CortiandFacebook GitHub Bot
a98528e609
Summary: Pull Request resolved: https://github.com/facebook/react-native/pull/48595 Historically React Native used to include the JitPack repository be default in the default repositories. This sadly exposes React Native projects to supply chain attacks as explained here: https://blog.oversecured.com/Introducing-MavenGate-a-supply-chain-attack-method-for-Java-and-Android-applications/ Moreover, artifacts on Jitpack are not GPG signed it's complicated to verify the identity of artifact authors. I'm introducing a Gradle property to control if Jitpack should be included by default or not. User can control this behavior by changing their `gradle.properties` file as such: ``` includeJitpackRepository=false ``` The default value of this property is currently true, but we're looking into changing it to false in the future. Changelog: [Android] [Added] - Make the addition of JitPack repository configurable Reviewed By: cipolleschi Differential Revision: D68016028 fbshipit-source-id: 392513fef389a4835b4e00a8184459e00d51fdd0