3

I just recieved a mail from Google play about my MobileFirst 6.3 app: Please migrate your app(s) to Apache Cordova v.4.1.1 or higher as soon as possible.

I have a new version of my app on MobileFirst 7.1, but this new version is only running on Cordova v 3.7.0.

Which version of MobileFirst will be based on v4.1.1 and when can we expect it, if it is not out already? What would be your advised approach, release the app based on cordova 3.7.0 quickly while we still can or wait for cordova 4.1.1 to be included in MobileFirst?

As requested: The following page contains more details about the vulnerabilities: https://support.google.com/faqs/answer/6325474

Stijn
  • 349
  • 1
  • 19

1 Answers1

3

No version of Worklight/MobileFirst is supplied with Cordova 4.1.1.

However,
IBM patches the Cordova version shipped in Worklight/MobileFirst with fixes to found vulnerabilities.

For this particular announcement by Google, see here: https://mobilefirstplatform.ibmcloud.com/blog/2016/02/16/ibm-mobilefirst-platform-foundation-responds-to-google-play-store-announcement-of-blocking-apps-using-vulnerable-cordova-versions/

In general:

Ensure that you are using the latest available Worklight/MobileFirst iFix and have the application re-built in order to use the patched Cordova.

See below for more information:

Idan Adar
  • 44,156
  • 13
  • 50
  • 89
  • I highly doubt a patched Cordova would suffice. Google Play Cordova scan is automated, and if it detects a wrong version, it rejects your app. This is also the case with unpatched apps not affected by the specific vulnerabilities. – Mister Smith Feb 10 '16 at 09:31
  • 1
    IBM is in contact with Google to ensure Google treats IBM's generated files diffferently. – Idan Adar Feb 10 '16 at 09:32
  • Wow I didn't knew that was even possible. I wish Google treated all developers in equal terms. I can't see Apple doing this. – Mister Smith Feb 10 '16 at 09:37
  • I am unable to edit the answer for some reason. Here is the updated blog post: https://mobilefirstplatform.ibmcloud.com/blog/2016/02/16/ibm-mobilefirst-platform-foundation-responds-to-google-play-store-announcement-of-blocking-apps-using-vulnerable-cordova-versions/ – Idan Adar Mar 31 '16 at 13:35