Update OpenSSL version in node dependencies

[devWaleed]

How frequently does the bug occur?

All the time

Description

I have an app that uses Realm js as a database. I recently submitted my app to Playstore for release and it rejected my app with the following error:

After doing some search through VS Code, I get that OpenSSL 1.1.1g is listed as dependency of this package. Also on Google's guide to fix this error also mentions Realm JS SDK having this open ssl version here: https://support.google.com/faqs/answer/12576638

Stacktrace & log output

No response

Can you reproduce the bug?

Yes, always

Reproduction Steps

1. Build the app
2. Submit to the Play store
3. Gets rejected with the error as shown above

Version

10.13.0 (latest version uses the same dependencies i checked)

What SDK flavour are you using?

Local Database only

Are you using encryption?

No, not using encryption

Platform OS and version(s)

Android and iOS

Build environment

Which debugger for React Native: ..

Cocoapods version

No response

[beisert1]

we are encountering the same issue, started happening this week. We are on older realm version v6 but still same error just on older version of openssl 1.1.1b

[biphan100897]

Update realm version 10.21.1.
You can change it in node_modules/realm/dependencies.list

[kneth]

In version 10.15.0 we upgraded our OpenSSL dependency from version 1.1.1g to 1.1.1n as part of the upgrade to Realm Core v11.13.0. Unfortunately CHANGELOG.md doesn't explicitly say it.

@biphan100897 I can see we forgot to update dependencies.list. In the past, the line decided which OpenSSL version to download but today it is determined by https://github.com/realm/realm-core/blob/master/dependencies.list#L3. We should remove the line in our repository to avoid confusion in the past.

[oseach1]

I have a same issue in version 10.20.0-beta.2.

I read all comments.
But I can't understand this issue solution.

Solution is update version? Or react-native core is update so I don't update realm version?

[devWaleed]

@kneth Yes, I saw that the realm core has updated the dependency list. But since it was listed in the realm dependency list as well. I thought an update is required.

So if I simply update my realm to the latest version 10.21.1 it should resolve the issue?

[kneth]

@oseach1

I have a same issue in version 10.20.0-beta.2.

You need to update to v10.20.0-beta.4 or v11.0.0-rc.X (X = 0,1,2)

[kneth]

@devWaleed

So if I simply update my realm to the latest version 10.21.1 it should resolve the issue?

Yes!

[Ping5841]

I still had the same issue in version v10.20.0-beta.5
@kneth

[kneth]

@Ping5841 v10.20.0-beta.5 should be using OpenSSL 1.1.1n. But in general I will suggest that you upgrade to v11.0.0.

[paritosh-yadav]

Hi @kneth ,
I check for all the above mentioned version, but all of them contains OPENSSL_VERSION=1.1.1g in node_modules/realm/dependencies.list
Kindly help.

[devWaleed]

This is how I solved it:

I updated the realm version to the latest, then I changed the OPENSSL_VERSION in node_modules since the latest version also has the dependencies.list file with the old version., compiled my app and submitted it to Play store. It was accepted and approved for public distribution.

I think updating it to the latest version will solve the issue. You can check this by compiling the app with the new version and submitting it for review. If there is a problem, they will show you the error within the 24 hours period.

[trapridge]

we are encountering the same issue, started happening this week. We are on older realm version v6 but still same error just on older version of openssl 1.1.1b

Were you able to solve this on v6 somehow?

[kneth]

Were you able to solve this on v6 somehow?

We don't plan to update version 6.

[victorroatt]

I'm still getting the error on v10.20.0-beta.X. Can anybody help me?

[kneth]

@victorroatt

I'm still getting the error on v10.20.0-beta.X. Can anybody help me?

Please upgrade to v11.2.0 (v10.20.0-beta.X ended with the release of v11.0.0).

[AnassHmida]

@kneth the upgraded version requires a re-setting up of flipper , an upgraded V10.20.0-beta-X with the OPENSSL 1.1.1n fix would be great if you could release one.

[kneth]

We are not planning to backport fixes to our old beta versions. Moreover, I believe v10.20.0-beta.5 is using OpenSSL 1.1.1n.

[AnassHmida]

@kneth as seen here : https://github.com/realm/realm-js/blob/v10.20.0-beta.5/dependencies.list

The OpenSSL version is still 1.1.1g

the v10.20.0-beta.5 does not use OpenSSL 1.1.1n.

[kneth]

Let me honest here: we forgot to update dependencies.list after we switch to CMake. v10.20.0-beta.5 is using Realm Core v11.14.0 which pulls in OpenSSL 1.1.1n: https://github.com/realm/realm-core/blob/33dd84212b64cd0788590a93be0dde64d2869abb/dependencies.list#L3

[gfirmacionpear]

Has anyone found a fix for this? Is updating realm to v11 the only solution?

[bishalkc]

Has anyone found a fix for this? Is updating realm to v11 the only solution?

I see same dependencies on v11 too

I see url-parse and openssl being reported in v10.24.0

[kneth]

We are currently (#5252) working on upgrading Realm Core which will give you OpenSSL 3.