Skip to content

iOS pod-install fails on RN 0.83+: podspec still references renamed React-Codegen pod (typosquat risk) #90

@jaltin

Description

@jaltin

Bug

@bugfender/rn-bugfender@5.0.1's podspec declares s.dependency \"React-Codegen\", but React Native 0.83+ renamed the codegen pod to ReactCodegen (no hyphen). The old name is no longer published as a local podspec by React Native, so CocoaPods falls back to the public Spec CDN — where a personal package (sjnscythe/React-Codegen v0.1.0) has been registered under that exact name and pulls source from https://github.com/sjnscythe/React-Codegen.git. That's effectively a typosquat in the dependency path. The clone has been failing in CI builds with:

```
Installing React-Codegen (0.1.0)
[!] Error installing React-Codegen
[!] /opt/homebrew/bin/git clone https://github.com/sjnscythe/React-Codegen.git ... --branch 0.1.0
fatal: unable to access '...': The requested URL returned error: 500
```

Reproduction

  • React Native 0.83.x (we use 0.83.4), `RCT_NEW_ARCH_ENABLED=1`.
  • Fresh `pod install` on a machine without a cached `Pods/` directory.
  • `@bugfender/rn-bugfender@5.0.1` in dependencies.

Affected file

`RnBugfender.podspec`, the `RCT_NEW_ARCH_ENABLED == '1'` block, line 30 in 5.0.1:

```ruby
s.dependency "React-Codegen"
```

Proposed fix

Update the new-arch dependency block to use the current pod name:

```diff

  • s.dependency "React-Codegen"
  • s.dependency "ReactCodegen"
    ```

Optionally guard with a React Native version detection if you want to keep the old name for users still on RN ≤ 0.79.

Our workaround until a fix ships

We patch the podspec via pnpm's `patchedDependencies`:

```diff
diff --git a/RnBugfender.podspec b/RnBugfender.podspec
@@ -27,7 +27,7 @@ Pod::Spec.new do |s|
"CLANG_CXX_LANGUAGE_STANDARD" => "c++17"
}

  • s.dependency "React-Codegen"
  • s.dependency "ReactCodegen"
    s.dependency "RCTRequired"
    s.dependency "RCTTypeSafety"
    s.dependency "React"
    ```

Security note

The fact that the deprecated name resolves to a personal repo on the CocoaPods CDN is a real risk for anyone still depending on `React-Codegen` from a pre-0.83 RN. Worth flagging to maintainers and possibly to the CocoaPods team for review.

Happy to open a PR with the one-line podspec change if that's helpful.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions