@capacitor/ios 8.4.3-nightly-20260730T154011.0 → 8.4.3

package/Capacitor/Capacitor/CAPApplicationDelegateProxy.swift

@@ -4,7 +4,7 @@ import Foundation
 public class ApplicationDelegateProxy: NSObject, UIApplicationDelegate {
     public static let shared = ApplicationDelegateProxy()
 
-    public internal(set) var lastURL: URL?
+    public private(set) var lastURL: URL?
 
     public func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey: Any] = [:]) -> Bool {
         NotificationCenter.default.post(name: .capacitorOpenURL, object: [

package/Capacitor/Capacitor/CAPNotifications.swift

@@ -18,10 +18,6 @@ extension Notification.Name {
     public static let capacitorStatusBarTapped = Notification.Name(rawValue: "CapacitorStatusBarTappedNotification")
     public static let capacitorViewDidAppear = Notification.Name(rawValue: "CapacitorViewDidAppear")
     public static let capacitorViewWillTransition = Notification.Name(rawValue: "CapacitorViewWillTransition")
-    public static let capacitorSceneWillConnect = Notification.Name(rawValue: "CapacitorSceneWillConnect")
-    public static let capacitorSceneOpenURL = Notification.Name(rawValue: "CapacitorSceneOpenURLNotification")
-    public static let capacitorSceneOpenUniversalLink =
-        Notification.Name(rawValue: "CapacitorSceneOpenUniversalLinkNotification")
 }
 
 @objc extension NSNotification {
@@ -34,9 +30,6 @@ extension Notification.Name {
     public static let capacitorStatusBarTapped = Notification.Name.capacitorStatusBarTapped
     public static let capacitorViewDidAppear = Notification.Name.capacitorViewDidAppear
     public static let capacitorViewWillTransition = Notification.Name.capacitorViewWillTransition
-    public static let capacitorSceneWillConnect = Notification.Name.capacitorSceneWillConnect
-    public static let capacitorSceneOpenURL = Notification.Name.capacitorSceneOpenURL
-    public static let capacitorSceneOpenUniversalLink = Notification.Name.capacitorSceneOpenUniversalLink
 }
 
 /**

package/Capacitor/Capacitor/CapacitorBridge.swift

@@ -93,6 +93,10 @@ open class CapacitorBridge: NSObject, CAPBridgeProtocol {
             }
         }
     }
+    @available(*, deprecated, message: "obsolete")
+    var tmpWindow: UIWindow?
+    @available(*, deprecated, message: "obsolete")
+    static let tmpVCAppeared = Notification(name: Notification.Name(rawValue: "tmpViewControllerAppeared"))
     public static let capacitorSite = "https://capacitorjs.com/"
     public static let fileStartIdentifier = "/_capacitor_file_"
     public static let httpInterceptorStartIdentifier = "/_capacitor_http_interceptor_"
@@ -213,12 +217,16 @@ open class CapacitorBridge: NSObject, CAPBridgeProtocol {
         super.init()
 
         self.webViewDelegationHandler.bridge = self
+        self.webViewAssetHandler.setConfiguration(configuration)
 
         exportCoreJS(localUrl: configuration.localURL.absoluteString)
         registerPlugins()
         setupCordovaCompatibility()
         exportMiscJS()
         canInjectJS = false
+        observers.append(NotificationCenter.default.addObserver(forName: type(of: self).tmpVCAppeared.name, object: .none, queue: .none) { [weak self] _ in
+            self?.tmpWindow = nil
+        })
 
         self.setupWebDebugging(configuration: configuration)
     }
@@ -263,16 +271,11 @@ open class CapacitorBridge: NSObject, CAPBridgeProtocol {
             exportCordovaJS()
             registerCordovaPlugins()
         } else {
-            observers.append(NotificationCenter.default.addObserver(forName: UIScene.willEnterForegroundNotification, object: nil, queue: OperationQueue.main) { [weak self] notification in
-                if let scene = notification.object as? UIWindowScene, scene === self?.viewController?.view.window?.windowScene {
-                    self?.triggerDocumentJSEvent(eventName: "resume")
-                }
-
+            observers.append(NotificationCenter.default.addObserver(forName: UIApplication.willEnterForegroundNotification, object: nil, queue: OperationQueue.main) { [weak self] (_) in
+                self?.triggerDocumentJSEvent(eventName: "resume")
             })
-            observers.append(NotificationCenter.default.addObserver(forName: UIScene.didEnterBackgroundNotification, object: nil, queue: OperationQueue.main) { [weak self] notification in
-                if let scene = notification.object as? UIWindowScene, scene === self?.viewController?.view.window?.windowScene {
-                    self?.triggerDocumentJSEvent(eventName: "pause")
-                }
+            observers.append(NotificationCenter.default.addObserver(forName: UIApplication.didEnterBackgroundNotification, object: nil, queue: OperationQueue.main) { [weak self] (_) in
+                self?.triggerDocumentJSEvent(eventName: "pause")
             })
         }
     }

package/Capacitor/Capacitor/TmpViewController.swift

@@ -0,0 +1,8 @@
+import UIKit
+
+internal class TmpViewController: UIViewController {
+    override func viewDidAppear(_ animated: Bool) {
+        super.viewDidAppear(animated)
+        NotificationCenter.default.post(CapacitorBridge.tmpVCAppeared)
+    }
+}

package/Capacitor/Capacitor/WebViewAssetHandler.swift

@@ -6,6 +6,7 @@ import UniformTypeIdentifiers
 open class WebViewAssetHandler: NSObject, WKURLSchemeHandler {
     private var router: Router
     private var serverUrl: URL?
+    private var configuration: InstanceConfiguration?
 
     public init(router: Router) {
         self.router = router
@@ -20,6 +21,10 @@ open class WebViewAssetHandler: NSObject, WKURLSchemeHandler {
         self.serverUrl = serverUrl
     }
 
+    open func setConfiguration(_ configuration: InstanceConfiguration?) {
+        self.configuration = configuration
+    }
+
     private func isUsingLiveReload(_ localUrl: URL) -> Bool {
         return self.serverUrl != nil && self.serverUrl?.scheme != localUrl.scheme
     }
@@ -31,7 +36,13 @@ open class WebViewAssetHandler: NSObject, WKURLSchemeHandler {
         let localUrl = URL.init(string: url.absoluteString)!
 
         if url.path.starts(with: CapacitorBridge.httpInterceptorStartIdentifier) {
-            handleCapacitorHttpRequest(urlSchemeTask, localUrl, false)
+            // Only serve the proxy when CapacitorHttp is on. A scheme task can't tell a document from
+            // a subresource, so keeping documents out relies on the check in decidePolicyFor.
+            if configuration?.getPluginConfig("CapacitorHttp").getBoolean("enabled", false) == true {
+                handleCapacitorHttpRequest(urlSchemeTask, localUrl, false)
+            } else {
+                urlSchemeTask.didFailWithError(URLError(.unsupportedURL))
+            }
             return
         }
 
@@ -152,12 +163,13 @@ open class WebViewAssetHandler: NSObject, WKURLSchemeHandler {
                     let existingHeaders = response.allHeaderFields
                     var newHeaders: [AnyHashable: Any] = [:]
 
+                    // Nothing should render this. If anything does, sandbox keeps it inert.
+                    newHeaders["Content-Security-Policy"] = "sandbox; frame-ancestors 'none'"
+
                     // if using live reload, then set CORS headers
                     if self.isUsingLiveReload(url) {
-                        newHeaders = [
-                            "Access-Control-Allow-Origin": self.serverUrl?.absoluteString ?? "",
-                            "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS, TRACE"
-                        ]
+                        newHeaders["Access-Control-Allow-Origin"] = self.serverUrl?.absoluteString ?? ""
+                        newHeaders["Access-Control-Allow-Methods"] = "GET, HEAD, OPTIONS, TRACE"
                     }
 
                     if let mergedHeaders = existingHeaders.merging(newHeaders, uniquingKeysWith: { (_, newHeaders) in newHeaders }) as? [String: String] {

package/Capacitor/Capacitor/WebViewDelegationHandler.swift

@@ -74,6 +74,12 @@ open class WebViewDelegationHandler: NSObject, WKNavigationDelegate, WKUIDelegat
             return
         }
 
+        // The proxy returns a remote body at the app origin, so block it before plugins can allow it.
+        if navURL.path.starts(with: CapacitorBridge.httpInterceptorStartIdentifier) {
+            decisionHandler(.cancel)
+            return
+        }
+
         // first, give plugins the chance to handle the decision
         for pluginObject in bridge.plugins {
             let plugin = pluginObject.value
@@ -107,7 +113,7 @@ open class WebViewDelegationHandler: NSObject, WKNavigationDelegate, WKUIDelegat
 
         if !isApplicationNavigation, toplevelNavigation {
             // disallow and let the system handle it
-            if webView.window?.windowScene?.activationState == .foregroundActive {
+            if UIApplication.shared.applicationState == .active {
                 UIApplication.shared.open(navURL, options: [:], completionHandler: nil)
             }
             decisionHandler(.cancel)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capacitor/ios",
-  "version": "8.4.3-nightly-20260730T154011.0",
+  "version": "8.4.3",
   "description": "Capacitor: Cross-platform apps with JavaScript and the web",
   "homepage": "https://capacitorjs.com",
   "author": "Ionic Team <hi@ionic.io> (https://ionic.io)",
@@ -25,7 +25,7 @@
     "xc:build:CapacitorCordova": "cd CapacitorCordova && xcodebuild && cd .."
   },
   "peerDependencies": {
-    "@capacitor/core": "^8.4.0-nightly-20260730T154011.0"
+    "@capacitor/core": "^8.4.0"
   },
   "publishConfig": {
     "access": "public"

package/Capacitor/Capacitor/CAPSceneDelegateProxy.swift

@@ -1,87 +0,0 @@
-//
-//  CAPSceneDelegateProxy.swift
-//  Capacitor
-//
-//  Created by Joseph Orlando Pender on 6/10/26.
-//  Copyright © 2026 Drifty Co. All rights reserved.
-//
-
-import Foundation
-
-@objc(CAPSceneDelegateProxy)
-public class SceneDelegateProxy: NSObject, UISceneDelegate {
-    public static let shared = SceneDelegateProxy()
-
-    public private(set) var lastURL: URL?
-
-    public func scene(_ scene: UIScene, willConnectTo session: UISceneSession, options connectionOptions: UIScene.ConnectionOptions) {
-        NotificationCenter.default.post(name: .capacitorSceneWillConnect, object: scene)
-
-        // Plugins haven't loaded yet on a cold start, so notifications posted here are
-        // missed. Deliver them on the first capacitorViewDidAppear, once plugins are
-        // registered.
-        var token: NSObjectProtocol?
-        token = NotificationCenter.default.addObserver(forName: .capacitorViewDidAppear, object: nil, queue: .main) { _ in
-            if let token {
-                NotificationCenter.default.removeObserver(token)
-            }
-            if !connectionOptions.urlContexts.isEmpty {
-                self.scene(scene, openURLContexts: connectionOptions.urlContexts)
-            }
-            for userActivity in connectionOptions.userActivities {
-                self.scene(scene, continue: userActivity)
-            }
-        }
-    }
-
-    public func scene(_ scene: UIScene, openURLContexts URLContexts: Set<UIOpenURLContext>) {
-        for context in URLContexts {
-            lastURL = context.url
-            ApplicationDelegateProxy.shared.lastURL = context.url
-            let options = Self.openURLOptions(from: context.options)
-
-            // Capacitor 8 backwards compat
-            NotificationCenter.default.post(name: .capacitorOpenURL, object: [
-                "url": context.url,
-                "options": options
-            ])
-
-            NotificationCenter.default.post(name: NSNotification.Name.CDVPluginHandleOpenURL, object: context.url)
-
-            NotificationCenter.default.post(name: .capacitorSceneOpenURL, object: scene, userInfo: [
-                "url": context.url,
-                "options": options
-            ])
-        }
-    }
-
-    public func scene(_ scene: UIScene, continue userActivity: NSUserActivity) {
-        guard userActivity.activityType == NSUserActivityTypeBrowsingWeb,
-              let url = userActivity.webpageURL else {
-            return
-        }
-        lastURL = url
-        ApplicationDelegateProxy.shared.lastURL = url
-
-        // Capacitor 8 backwards compat
-        NotificationCenter.default.post(name: .capacitorOpenUniversalLink, object: [
-            "url": url
-        ])
-
-        NotificationCenter.default.post(name: .capacitorSceneOpenUniversalLink, object: scene, userInfo: [
-            "url": url
-        ])
-    }
-
-    private static func openURLOptions(from sceneOptions: UIScene.OpenURLOptions) -> [UIApplication.OpenURLOptionsKey: Any] {
-        var options: [UIApplication.OpenURLOptionsKey: Any] = [:]
-        if let sourceApplication = sceneOptions.sourceApplication {
-            options[.sourceApplication] = sourceApplication
-        }
-        if let annotation = sceneOptions.annotation {
-            options[.annotation] = annotation
-        }
-        options[.openInPlace] = sceneOptions.openInPlace
-        return options
-    }
-}