@capgo/capacitor-updater 8.51.15 → 8.51.17

package/CapgoCapacitorUpdater.podspec

@@ -16,7 +16,5 @@ Pod::Spec.new do |s|
   s.dependency 'ZIPFoundation', '~> 0.9'
   s.dependency 'Alamofire', '5.10.2'
   s.dependency 'Version', '0.8.0'
-  # We cannot update to latest because it not published anymore in cocoa https://github.com/attaswift/BigInt/issues/94
-  s.dependency 'BigInt', '5.2.0'
   s.swift_version = '5.1'
 end

package/Package.swift

@@ -13,8 +13,7 @@ let package = Package(
         .package(url: "https://github.com/ionic-team/capacitor-swift-pm.git", from: "8.0.0"),
         .package(url: "https://github.com/Alamofire/Alamofire.git", .upToNextMajor(from: "5.12.0")),
         .package(url: "https://github.com/weichsel/ZIPFoundation.git", from: "0.9.20"),
-        .package(url: "https://github.com/mrackwitz/Version.git", exact: "0.8.0"),
-        .package(url: "https://github.com/attaswift/BigInt.git", from: "5.7.0")
+        .package(url: "https://github.com/mrackwitz/Version.git", exact: "0.8.0")
     ],
     targets: [
         .target(
@@ -24,8 +23,7 @@ let package = Package(
                 .product(name: "Cordova", package: "capacitor-swift-pm"),
                 .product(name: "ZIPFoundation", package: "ZIPFoundation"),
                 .product(name: "Alamofire", package: "Alamofire"),
-                .product(name: "Version", package: "Version"),
-                .product(name: "BigInt", package: "BigInt")
+                .product(name: "Version", package: "Version")
             ],
             path: "ios/Sources/CapacitorUpdaterPlugin"),
         .testTarget(

package/android/build.gradle

@@ -3,6 +3,7 @@ ext {
     androidxAppCompatVersion = project.hasProperty('androidxAppCompatVersion') ? rootProject.ext.androidxAppCompatVersion : '1.7.1'
     androidxJunitVersion = project.hasProperty('androidxJunitVersion') ? rootProject.ext.androidxJunitVersion : '1.3.0'
     androidxEspressoCoreVersion = project.hasProperty('androidxEspressoCoreVersion') ? rootProject.ext.androidxEspressoCoreVersion : '3.7.0'
+    okhttpVersion = project.hasProperty('okhttpVersion') ? rootProject.ext.okhttpVersion : '4.12.0'
 }
 
 buildscript {
@@ -54,7 +55,6 @@ dependencies {
     implementation "androidx.work:work-runtime:$work_version"
     implementation "androidx.lifecycle:lifecycle-process:$lifecycle_version"
     implementation "com.google.android.gms:play-services-tasks:18.4.1"
-    implementation "com.google.guava:guava:33.6.0-android"
     implementation fileTree(dir: 'libs', include: ['*.jar'])
     implementation project(':capacitor-android')
     implementation "androidx.appcompat:appcompat:$androidxAppCompatVersion"
@@ -65,11 +65,11 @@ dependencies {
     testImplementation "junit:junit:$junitVersion"
     testImplementation 'org.mockito:mockito-core:5.23.0'
     testImplementation 'org.json:json:20250517'
-    testImplementation 'org.robolectric:robolectric:4.16.1'
+    testImplementation 'org.robolectric:robolectric:4.17'
     androidTestImplementation "androidx.test.ext:junit:$androidxJunitVersion"
     androidTestImplementation "androidx.test.espresso:espresso-core:$androidxEspressoCoreVersion"
     implementation 'org.brotli:dec:0.1.2'
-    implementation 'com.squareup.okhttp3:okhttp:5.4.0'
+    implementation "com.squareup.okhttp3:okhttp:$okhttpVersion"
 }
 
 tasks.withType(Test) {

package/android/src/main/java/ee/forgr/capacitor_updater/CapacitorUpdaterPlugin.java

@@ -146,7 +146,7 @@ public class CapacitorUpdaterPlugin extends Plugin {
     static final int APPLICATION_EXIT_REASON_USER_REQUESTED = 10;
     static final int APPLICATION_EXIT_REASON_DEPENDENCY_DIED = 12;
 
-    private final String pluginVersion = "8.51.15";
+    private final String pluginVersion = "8.51.17";
     private static final String DELAY_CONDITION_PREFERENCES = "";
 
     private SharedPreferences.Editor editor;
@@ -290,6 +290,7 @@ public class CapacitorUpdaterPlugin extends Plugin {
 
     // Play Store In-App Updates
     private AppUpdateManager appUpdateManager;
+    private PluginCall pendingAppUpdateCall;
     private AppUpdateInfo cachedAppUpdateInfo;
     private static final int APP_UPDATE_REQUEST_CODE = 9001;
     private InstallStateUpdatedListener installStateUpdatedListener;
@@ -2532,11 +2533,15 @@ public class CapacitorUpdaterPlugin extends Plugin {
             call.reject("setUpdateUrl called without url");
             return;
         }
-        this.updateUrl = url;
         if (Boolean.TRUE.equals(this.persistModifyUrl)) {
             this.editor.putString(UPDATE_URL_PREF_KEY, url);
-            this.editor.apply();
+            if (!this.editor.commit()) {
+                logger.error("Failed to persist updateUrl");
+                call.reject("Failed to persist updateUrl");
+                return;
+            }
         }
+        this.updateUrl = url;
         call.resolve();
     }
 
@@ -2553,11 +2558,15 @@ public class CapacitorUpdaterPlugin extends Plugin {
             call.reject("setStatsUrl called without url");
             return;
         }
-        this.implementation.statsUrl = url;
         if (Boolean.TRUE.equals(this.persistModifyUrl)) {
             this.editor.putString(STATS_URL_PREF_KEY, url);
-            this.editor.apply();
+            if (!this.editor.commit()) {
+                logger.error("Failed to persist statsUrl");
+                call.reject("Failed to persist statsUrl");
+                return;
+            }
         }
+        this.implementation.statsUrl = url;
         call.resolve();
     }
 
@@ -2574,11 +2583,15 @@ public class CapacitorUpdaterPlugin extends Plugin {
             call.reject("setChannelUrl called without url");
             return;
         }
-        this.implementation.channelUrl = url;
         if (Boolean.TRUE.equals(this.persistModifyUrl)) {
             this.editor.putString(CHANNEL_URL_PREF_KEY, url);
-            this.editor.apply();
+            if (!this.editor.commit()) {
+                logger.error("Failed to persist channelUrl");
+                call.reject("Failed to persist channelUrl");
+                return;
+            }
         }
+        this.implementation.channelUrl = url;
         call.resolve();
     }
 
@@ -5667,8 +5680,13 @@ public class CapacitorUpdaterPlugin extends Plugin {
                 return;
             }
 
-            // Save the call for later resolution
-            bridge.saveCall(call);
+            if (pendingAppUpdateCall != null) {
+                call.reject("An app update flow is already in progress");
+                return;
+            }
+
+            call.setKeepAlive(true);
+            pendingAppUpdateCall = call;
 
             AppUpdateManager manager = getAppUpdateManager();
             manager.startUpdateFlowForResult(
@@ -5740,8 +5758,13 @@ public class CapacitorUpdaterPlugin extends Plugin {
 
             manager.registerListener(installStateUpdatedListener);
 
-            // Save the call for later resolution
-            bridge.saveCall(call);
+            if (pendingAppUpdateCall != null) {
+                call.reject("An app update flow is already in progress");
+                return;
+            }
+
+            call.setKeepAlive(true);
+            pendingAppUpdateCall = call;
 
             manager.startUpdateFlowForResult(
                 cachedAppUpdateInfo,
@@ -5782,11 +5805,11 @@ public class CapacitorUpdaterPlugin extends Plugin {
         super.handleOnActivityResult(requestCode, resultCode, data);
 
         if (requestCode == APP_UPDATE_REQUEST_CODE) {
-            PluginCall savedCall = bridge.getSavedCall("com.getcapacitor.PluginCall");
+            PluginCall savedCall = pendingAppUpdateCall;
             if (savedCall == null) {
-                // Try to get any saved call (for backward compatibility)
                 return;
             }
+            pendingAppUpdateCall = null;
 
             JSObject result = new JSObject();
             if (resultCode == Activity.RESULT_OK) {
@@ -5796,8 +5819,8 @@ public class CapacitorUpdaterPlugin extends Plugin {
             } else {
                 result.put("code", RESULT_FAILED);
             }
+            savedCall.setKeepAlive(false);
             savedCall.resolve(result);
-            bridge.releaseCall(savedCall);
         }
     }
 

package/android/src/main/java/ee/forgr/capacitor_updater/CapgoUpdater.java

@@ -23,8 +23,6 @@ import androidx.work.OneTimeWorkRequest;
 import androidx.work.PeriodicWorkRequest;
 import androidx.work.WorkInfo;
 import androidx.work.WorkManager;
-import com.google.common.util.concurrent.Futures;
-import com.google.common.util.concurrent.ListenableFuture;
 import java.io.BufferedInputStream;
 import java.io.BufferedReader;
 import java.io.File;
@@ -2901,6 +2899,11 @@ public class CapgoUpdater {
                     statsQueue.add(new QueuedStatsEvent(arr.getJSONObject(i), null));
                 }
             }
+            if (backup.exists() && !backup.delete()) {
+                if (logger != null) {
+                    logger.error("Failed to delete stats backup");
+                }
+            }
             if (!statsQueue.isEmpty()) {
                 if (logger != null) {
                     logger.info("Restored " + statsQueue.size() + " pending stats events");
@@ -2956,9 +2959,11 @@ public class CapgoUpdater {
             }
             try {
                 if (arr.length() == 0) {
-                    if (file.exists() && !file.delete()) {
+                    writeFileAtomically(file, "[]".getBytes(StandardCharsets.UTF_8));
+                    File backup = new File(file.getAbsolutePath() + ".bak");
+                    if (backup.exists() && !backup.delete()) {
                         if (logger != null) {
-                            logger.error("Failed to delete empty stats queue file");
+                            logger.error("Failed to delete empty stats backup");
                         }
                     }
                     return;
@@ -2989,7 +2994,7 @@ public class CapgoUpdater {
         }
     }
 
-    private static void writeFileAtomically(final File file, final byte[] bytes) throws IOException {
+    private void writeFileAtomically(final File file, final byte[] bytes) throws IOException {
         final File tmp = new File(file.getAbsolutePath() + ".tmp");
         File backup = null;
         try {
@@ -3011,7 +3016,9 @@ public class CapgoUpdater {
             }
             if (tmp.renameTo(file)) {
                 if (backup != null && backup.exists() && !backup.delete()) {
-                    backup.deleteOnExit();
+                    if (logger != null) {
+                        logger.error("Failed to delete stats backup");
+                    }
                 }
                 backup = null;
                 return;

package/android/src/main/java/ee/forgr/capacitor_updater/DelayUpdateUtils.java

@@ -75,6 +75,17 @@ public class DelayUpdateUtils {
                                     ", longValue: " +
                                     longValue
                             );
+                        } else {
+                            delayConditionListToKeep.add(condition);
+                            logger.info(
+                                "Background delay (value: " +
+                                    value +
+                                    ") condition kept at index " +
+                                    index +
+                                    " (source: " +
+                                    source.toString() +
+                                    ")"
+                            );
                         }
                     } else {
                         delayConditionListToKeep.add(condition);

package/ios/Sources/CapacitorUpdaterPlugin/BundleInfo.swift

@@ -69,6 +69,10 @@ import Foundation
         return BundleStatus.DELETING == self.status
     }
 
+    public func isDownloading() -> Bool {
+        return BundleStatus.DOWNLOADING == self.status
+    }
+
     public func isDownloaded() -> Bool {
         return !self.isBuiltin() && self.downloaded != "" &&
             self.downloaded != BundleInfo.DOWNLOADED_BUILTIN && !self.isDeleted() && !self.isDeleting()

package/ios/Sources/CapacitorUpdaterPlugin/CapacitorUpdaterPlugin.swift

@@ -96,7 +96,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
     deinit {
         implementation.shutdown()
     }
-    private let pluginVersion: String = "8.51.15"
+    private let pluginVersion: String = "8.51.17"
     private let launchStartedAtMs = Int64(Date().timeIntervalSince1970 * 1000)
     static let updateUrlDefault = "https://plugin.capgo.app/updates"
     static let statsUrlDefault = "https://plugin.capgo.app/stats"
@@ -191,9 +191,12 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
 
     // Lock to ensure cleanup completes before downloads start
     private let cleanupLock = NSLock()
+    // Short lock for cleanupComplete/cleanupTimedOut only. Never hold across cleanupGroup.wait.
+    private let cleanupStateLock = NSLock()
     private let defaultChannelStateLock = NSLock()
     private let cleanupGroup = DispatchGroup()
     private var cleanupComplete = false
+    private var cleanupTimedOut = false
     private var cleanupThread: Thread?
     private var defaultChannelCleanupMustRetry = false
     private var persistCustomId = false
@@ -216,6 +219,8 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
     // Best-effort flag: set before we expect notifyAppReady (load/reload).
     // No lock — never held across waits; a rare race only mis-times one wait.
     private var pendingNotifyAppReady = false
+    private let semaphoreWaitTestingLock = NSLock()
+    private var didEnterSemaphoreWaitForTesting = false
 
     private var delayUpdateUtils: DelayUpdateUtils!
 
@@ -427,7 +432,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
 
         // Downloads (including shake-menu / CapgoUpdater entry points) wait on this gate.
         self.implementation.beforeDownload = { [weak self] in
-            self?.waitForCleanupIfNeeded()
+            try self?.waitForCleanupIfNeeded()
         }
         // Always run async cleanup: delete obsolete bundles on native update (when enabled)
         // and sweep orphan directories every launch. Must not block app startup.
@@ -594,6 +599,9 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
 
     private func semaphoreWait(waitTime: Int) {
         // print("\\(CapgoUpdater.TAG) semaphoreWait \\(waitTime)")
+        semaphoreWaitTestingLock.lock()
+        didEnterSemaphoreWaitForTesting = true
+        semaphoreWaitTestingLock.unlock()
         let result = semaphoreReady.wait(timeout: .now() + .milliseconds(waitTime))
         if result == .timedOut {
             logger.error("Semaphore wait timed out after \(waitTime)ms")
@@ -1035,9 +1043,12 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
     }
 
     private func cleanupObsoleteVersions(resetWhenUpdate: Bool = true, didResetCurrentBundle: Bool = false) {
-        // Enter before start so waiters never race past an unstarted cleanup thread.
+        // Enter before publishing incomplete state so waiters cannot hit an empty group.
+        self.cleanupStateLock.lock()
         self.cleanupComplete = false
+        self.cleanupTimedOut = false
         self.cleanupGroup.enter()
+        self.cleanupStateLock.unlock()
         cleanupThread = Thread {
             let bgTaskLock = NSLock()
             var cleanupBackgroundTask = UIBackgroundTaskIdentifier.invalid
@@ -1054,7 +1065,9 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
             }
             self.cleanupLock.lock()
             defer {
+                self.cleanupStateLock.lock()
                 self.cleanupComplete = true
+                self.cleanupStateLock.unlock()
                 self.cleanupLock.unlock()
                 self.cleanupGroup.leave()
                 endCleanupBackgroundTask()
@@ -1139,17 +1152,39 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         cleanupThread?.start()
     }
 
-    private func waitForCleanupIfNeeded() {
-        if cleanupComplete {
+    private func cleanupTimeoutError() -> NSError {
+        NSError(
+            domain: "CapacitorUpdater",
+            code: 1,
+            userInfo: [NSLocalizedDescriptionKey: "Cleanup did not finish before download"]
+        )
+    }
+
+    private func waitForCleanupIfNeeded() throws {
+        cleanupStateLock.lock()
+        let alreadyDone = cleanupComplete
+        let alreadyTimedOut = cleanupTimedOut
+        cleanupStateLock.unlock()
+        if alreadyDone {
             return  // Already done, no need to wait
         }
+        if alreadyTimedOut {
+            throw cleanupTimeoutError()
+        }
 
         logger.info("Waiting for cleanup to complete before starting download...")
         let result = cleanupGroup.wait(timeout: .now() + .seconds(60))
         if result == .timedOut {
             logger.warn("Cleanup wait timed out after 60s, cancelling leftover cleanup")
             cleanupThread?.cancel()
-            _ = cleanupGroup.wait(timeout: .now() + .seconds(60))
+            let cancelled = cleanupGroup.wait(timeout: .now() + .seconds(60))
+            if cancelled == .timedOut {
+                cleanupStateLock.lock()
+                cleanupTimedOut = true
+                cleanupStateLock.unlock()
+                logger.error("Cleanup did not finish after cancel, aborting download")
+                throw cleanupTimeoutError()
+            }
             return
         }
         logger.info("Cleanup finished, proceeding with download")
@@ -1159,6 +1194,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         let resolve = {
             let savedCall = self.bridge?.savedCall(withID: call.callbackId)
             let targetCall = savedCall ?? call
+            targetCall.keepAlive = false
 
             if let data {
                 targetCall.resolve(data)
@@ -1184,6 +1220,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         let reject = {
             let savedCall = self.bridge?.savedCall(withID: call.callbackId)
             let targetCall = savedCall ?? call
+            targetCall.keepAlive = false
 
             targetCall.reject(message, code, error, data)
 
@@ -1202,7 +1239,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
     }
 
     private func saveCallForAsyncHandling(_ call: CAPPluginCall) {
-        bridge?.saveCall(call)
+        call.keepAlive = true
     }
 
     private func notifyListenersOnMain(_ eventName: String, data: JSObject) {
@@ -1568,8 +1605,6 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
     }
 
     private func downloadBundle(urlString: String, version: String, sessionKey: String, checksum rawChecksum: String, manifestEntries: [ManifestEntry]?) throws -> BundleInfo {
-        // Manual/preview downloads must wait too - launch orphan sweep can delete their temps.
-        self.waitForCleanupIfNeeded()
         guard let url = URL(string: urlString) else {
             throw makePreviewError("Invalid download URL")
         }
@@ -1809,6 +1844,14 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         }
     }
 
+    private func queueBundleForNextBackgroundInstall(_ next: BundleInfo) -> Bool {
+        guard self.implementation.setNextBundle(next: next.getId()) else {
+            self.logger.error("Failed to queue downloaded bundle as next: \(next.toString())")
+            return false
+        }
+        return true
+    }
+
     private func applyDownloadedBundleForDirectUpdate(_ next: BundleInfo) -> Bool {
         let previousState = self.implementation.captureResetState()
         let previousBundleName = self.implementation.getCurrentBundle().getVersionName()
@@ -3993,6 +4036,13 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         isAutoUpdateModeEnabled(autoUpdateMode) && autoUpdateMode != autoUpdateModeOnlyDownload
     }
 
+    /// Incomplete leftovers must be downloaded again. Android already skips
+    /// `DOWNLOADING` here; iOS used to treat them as ready, then `setNextBundle`
+    /// failed quietly and the update never applied.
+    static func shouldRetryDownloadForExistingBundle(_ bundle: BundleInfo) -> Bool {
+        bundle.isDeleted() || bundle.isDeleting() || bundle.isDownloading()
+    }
+
     static func isDirectUpdateMode(_ directUpdateMode: String) -> Bool {
         directUpdateMode == autoUpdateModeInstall || directUpdateMode == autoUpdateModeLaunch || directUpdateMode == autoUpdateModeAlways
     }
@@ -4063,6 +4113,18 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         pendingNotifyAppReady = true
     }
 
+    func resetSemaphoreWaitTestingStateForTesting() {
+        semaphoreWaitTestingLock.lock()
+        didEnterSemaphoreWaitForTesting = false
+        semaphoreWaitTestingLock.unlock()
+    }
+
+    var didEnterSemaphoreWaitForTestingState: Bool {
+        semaphoreWaitTestingLock.lock()
+        defer { semaphoreWaitTestingLock.unlock() }
+        return didEnterSemaphoreWaitForTesting
+    }
+
     func clearPendingNotifyAppReadyForTesting() {
         clearPendingNotifyAppReady()
     }
@@ -4298,7 +4360,14 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
                 return
             }
             // File mutations wait here. getLatest already ran in parallel with cleanup.
-            self.waitForCleanupIfNeeded()
+            do {
+                try self.waitForCleanupIfNeeded()
+            } catch {
+                self.logger.error("Cleanup still running, skipping download")
+                self.clearDownloadInProgressState()
+                self.endBackGroundTask()
+                return
+            }
             current = self.implementation.getCurrentBundle()
             if res.version == "builtin" {
                 self.logger.info("Latest version is builtin")
@@ -4361,14 +4430,16 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
                 do {
                     self.logger.info("New bundle: \(latestVersionName) found. Current is: \(current.getVersionName()). \(messageUpdate)")
                     var nextImpl = self.implementation.getBundleInfoByVersionName(version: latestVersionName)
-                    if nextImpl == nil || nextImpl?.isDeleted() == true {
-                        if nextImpl?.isDeleted() == true {
-                            self.logger.info("Latest bundle already exists and will be deleted, download will overwrite it.")
-                            let res = self.implementation.delete(id: nextImpl!.getId(), removeInfo: true)
-                            if res {
-                                self.logger.info("Failed bundle deleted: \(nextImpl!.toString())")
+                    let needsDownload = nextImpl.map(Self.shouldRetryDownloadForExistingBundle) ?? true
+                    if needsDownload {
+                        if let existing = nextImpl {
+                            self.logger.info("Latest bundle already exists in incomplete state (\(existing.getStatus())) and will be deleted, download will overwrite it.")
+                            _ = self.implementation.setNextBundle(next: Optional<String>.none)
+                            let deleted = self.implementation.delete(id: existing.getId(), removeInfo: true)
+                            if deleted {
+                                self.logger.info("Incomplete bundle deleted: \(existing.toString())")
                             } else {
-                                self.logger.error("Failed to delete failed bundle: \(nextImpl!.toString())")
+                                self.logger.error("Failed to delete incomplete bundle: \(existing.toString())")
                             }
                         }
                         self.consumeOnLaunchDirectUpdateAttempt(plannedDirectUpdate: plannedDirectUpdate)
@@ -4455,8 +4526,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
                                 error: false,
                                 plannedDirectUpdate: plannedDirectUpdate
                             )
-                        } else {
-                            _ = self.implementation.setNextBundle(next: next.getId())
+                        } else if self.queueBundleForNextBackgroundInstall(next) {
                             self.notifyListeners("updateAvailable", data: ["bundle": next.toJSON()])
                             self.endBackGroundTaskWithNotif(
                                 msg: "Direct update reload failed, update will install next background",
@@ -4465,20 +4535,35 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
                                 error: false,
                                 plannedDirectUpdate: plannedDirectUpdate
                             )
+                        } else {
+                            self.endBackGroundTaskWithNotif(
+                                msg: "Direct update reload failed, and next bundle could not be queued",
+                                latestVersionName: latestVersionName,
+                                current: current,
+                                plannedDirectUpdate: plannedDirectUpdate
+                            )
                         }
                     } else if self.shouldAutoSetNextBundle() {
                         if plannedDirectUpdate && !directUpdateAllowed {
                             self.logger.info("Direct update skipped because splashscreen timeout occurred. Update will install on next app background.")
                         }
-                        self.notifyListeners("updateAvailable", data: ["bundle": next.toJSON()])
-                        _ = self.implementation.setNextBundle(next: next.getId())
-                        self.endBackGroundTaskWithNotif(
-                            msg: "update downloaded, will install next background",
-                            latestVersionName: latestVersionName,
-                            current: current,
-                            error: false,
-                            plannedDirectUpdate: plannedDirectUpdate
-                        )
+                        if self.queueBundleForNextBackgroundInstall(next) {
+                            self.notifyListeners("updateAvailable", data: ["bundle": next.toJSON()])
+                            self.endBackGroundTaskWithNotif(
+                                msg: "update downloaded, will install next background",
+                                latestVersionName: latestVersionName,
+                                current: current,
+                                error: false,
+                                plannedDirectUpdate: plannedDirectUpdate
+                            )
+                        } else {
+                            self.endBackGroundTaskWithNotif(
+                                msg: "Update downloaded, but next bundle could not be queued",
+                                latestVersionName: latestVersionName,
+                                current: current,
+                                plannedDirectUpdate: plannedDirectUpdate
+                            )
+                        }
                     } else {
                         self.logger.info("autoUpdate is set to onlyDownload, downloaded update will not be set as next bundle")
                         self.notifyListeners("updateAvailable", data: ["bundle": next.toJSON()], retainUntilConsumed: true)

package/ios/Sources/CapacitorUpdaterPlugin/CapgoRawRsa.swift

@@ -0,0 +1,36 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+
+import Foundation
+import Security
+import os.log
+
+/// Isolated raw RSA primitives for Capgo v2 checksum/session-key recovery.
+/// SonarCloud automatic analysis has no Swift // NOSONAR; swift:S5542 is ignored
+/// via `.sonarcloud.properties` multicriteria because `.rsaEncryptionRaw` is
+/// intentional wire compatibility with Node `privateEncrypt` / `publicDecrypt`.
+enum CapgoRawRsa {
+    private static let log = OSLog(subsystem: "ee.forgr.capacitor_updater", category: "RSA")
+
+    static func supportsCapgoRecovery(key: SecKey) -> Bool {
+        SecKeyGetBlockSize(key) == 256
+            && SecKeyIsAlgorithmSupported(key, .encrypt, .rsaEncryptionRaw) // NOSONAR intentional raw RSA for Node privateEncrypt / Capgo checksum recovery
+    }
+
+    static func recoverSignatureBlock(key: SecKey, data: Data) -> Data? {
+        var error: Unmanaged<CFError>?
+        guard let recovered = SecKeyCreateEncryptedData(key, .rsaEncryptionRaw, data as CFData, &error) as Data? else { // NOSONAR intentional raw RSA for Node privateEncrypt / Capgo checksum recovery
+            os_log(
+                "RSA raw recovery failed: %{public}@",
+                log: log,
+                type: .error,
+                String(describing: error?.takeRetainedValue())
+            )
+            return nil
+        }
+        return recovered
+    }
+}

package/ios/Sources/CapacitorUpdaterPlugin/CapgoUpdater.swift

@@ -45,7 +45,7 @@ import UIKit
     public var timeout: Double = 20
     public var statsUrl: String = ""
     /// Optional gate run before any download touches disk (e.g. wait for launch cleanup).
-    public var beforeDownload: (() -> Void)?
+    public var beforeDownload: (() throws -> Void)?
     public var channelUrl: String = ""
     public var defaultChannel: String = ""
     public var appId: String = ""
@@ -928,10 +928,7 @@ import UIKit
 
     struct ManifestLookupEntry {
         let hash: String
-        /// The manifest's own file name, `.br` suffix included when present. The
-        /// built-in bundle stores files under this exact name (see
-        /// isManifestEntryAvailableLocally), unlike the extracted/cached copy which
-        /// is always named without the suffix.
+        /// The manifest's own file name, `.br` suffix included when present.
         let originalFileName: String
     }
 
@@ -994,10 +991,14 @@ import UIKit
 
             // Builtin is already a permanent reuse source (see isManifestEntryAvailableLocally),
             // so there's no need to also duplicate this file into the delta cache
-            let builtinRelativePath = knownEntry?.originalFileName ?? relativePath
-            let builtinFilePath = builtinFolder.appendingPathComponent(builtinRelativePath)
-            let isBuiltinOrigin = fileManager.fileExists(atPath: builtinFilePath.path) &&
-                verifyChecksum(file: builtinFilePath, expectedHash: checksum)
+            let builtinLookupName = knownEntry?.originalFileName ?? relativePath
+            let isBuiltinOrigin: Bool
+            if let builtinFilePath = try? Self.resolveManifestTargetPath(baseDirectory: builtinFolder, fileName: builtinLookupName) {
+                isBuiltinOrigin = fileManager.fileExists(atPath: builtinFilePath.path) &&
+                    verifyChecksum(file: builtinFilePath, expectedHash: checksum)
+            } else {
+                isBuiltinOrigin = false
+            }
             if isBuiltinOrigin {
                 continue
             }
@@ -1231,7 +1232,10 @@ import UIKit
         }
 
         let builtinFolder = self.builtinFolderURL()
-        let builtinFilePath = builtinFolder.appendingPathComponent(fileName)
+        // The .br suffix describes transport; builtin assets are uncompressed.
+        guard let builtinFilePath = try? Self.resolveManifestTargetPath(baseDirectory: builtinFolder, fileName: fileName) else {
+            return false
+        }
         if FileManager.default.fileExists(atPath: builtinFilePath.path) && verifyChecksum(file: builtinFilePath, expectedHash: fileHash) {
             return true
         }
@@ -1365,12 +1369,12 @@ import UIKit
         return json
     }
 
-    private func runBeforeDownload() {
-        beforeDownload?()
+    private func runBeforeDownload() throws {
+        try beforeDownload?()
     }
 
     public func downloadManifest(manifest: [ManifestEntry], version: String, sessionKey: String, link: String? = nil, comment: String? = nil) throws -> BundleInfo {
-        self.runBeforeDownload()
+        try self.runBeforeDownload()
         let id = self.randomString(length: 10)
         logger.info("downloadManifest start \(id)")
         let destFolder = self.getBundleDirectory(id: id)
@@ -1474,7 +1478,7 @@ import UIKit
             let builtinFilePath: URL
             do {
                 destFilePath = try Self.resolveManifestTargetPath(baseDirectory: destFolder, fileName: fileName)
-                builtinFilePath = try Self.resolvePathInsideDirectory(baseDirectory: builtinFolder, relativePath: fileName)
+                builtinFilePath = try Self.resolveManifestTargetPath(baseDirectory: builtinFolder, fileName: fileName)
             } catch {
                 logger.error("Invalid manifest file path: \(fileName)")
                 self.sendStats(action: "manifest_path_fail", versionName: "\(version):\(fileName)")
@@ -1973,7 +1977,7 @@ import UIKit
     }
 
     public func download(url: URL, version: String, sessionKey: String, link: String? = nil, comment: String? = nil) throws -> BundleInfo {
-        self.runBeforeDownload()
+        try self.runBeforeDownload()
         let id: String = self.randomString(length: 10)
         // Each download uses its own temp files keyed by bundle ID to prevent collisions
         if version != getLocalUpdateVersion(for: id) {

package/ios/Sources/CapacitorUpdaterPlugin/Logger.swift

@@ -138,17 +138,17 @@ public class Logger {
         self.tag = tag
         if let config = config {
             // The logger plugin's name is LoggerBridge, we want to look at the config
-            // named "Logger", so we can't use plugin.getConfigValue().
-            if let configLevel = getConfigValue("level", from: config) as? String,
+            // named "Logger", so we can't use the Capacitor plugin config helper.
+            if let configLevel = instanceConfigValue("level", from: config) as? String,
                let logLevel = LogLevel[configLevel] {
                 level = logLevel
             }
 
-            if let configLabels = getConfigValue("labels", from: config) as? [String: String] {
+            if let configLabels = instanceConfigValue("labels", from: config) as? [String: String] {
                 labels = configLabels
             }
 
-            if let configSyslog = getConfigValue("useSyslog", from: config) as? Bool {
+            if let configSyslog = instanceConfigValue("useSyslog", from: config) as? Bool {
                 useSyslog = configSyslog
             }
         }
@@ -160,7 +160,7 @@ public class Logger {
         }
     }
 
-    private func getConfigValue(_ configKey: String, from config: InstanceConfiguration) -> Any? {
+    private func instanceConfigValue(_ configKey: String, from config: InstanceConfiguration) -> Any? {
         if let config = config.pluginConfigurations as? JSObject {
             return config[keyPath: KeyPath(stringLiteral: "Logger.\(configKey)")]
         }

package/ios/Sources/CapacitorUpdaterPlugin/RSA.swift

@@ -1,274 +1,96 @@
-import BigInt
-import Foundation
-import CommonCrypto
-import CryptoKit
-
-///
-/// Constants
-///
-private enum RSAConstants {
-    static let rsaKeySizeInBits: NSNumber = 2048
-    static let rsaAlgorithm: SecKeyAlgorithm = .rsaEncryptionOAEPSHA256
-}
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ */
 
-// We do all this stuff because ios is shit and open source libraries allow to do decryption with public key
-// So we have to do it manually, while in nodejs or Java it's ok and done at language level.
+import Foundation
+import Security
+import os.log
 
-///
-/// The RSA public key.
-///
+/// Capgo v2 uses Node's privateEncrypt with PKCS#1 v1.5 type-1 padding for
+/// checksums and session keys. Recover the signed payload using Apple's RSA
+/// implementation instead of custom modular exponentiation.
 public struct RSAPublicKey {
-    private let manualKey: ManualRSAPublicKey
-
-    fileprivate init(manualKey: ManualRSAPublicKey) {
-        self.manualKey = manualKey
-    }
-
-    ///
-    /// Takes the data and uses the public key to decrypt it.
-    /// Returns the decrypted data.
-    ///
-    public func decrypt(data: Data) -> Data? {
-        return manualKey.decrypt(data)
-    }
+    private let key: SecKey
+    private static let keyLock = NSLock()
+    private static let log = OSLog(subsystem: "ee.forgr.capacitor_updater", category: "RSA")
+    // One public key only: bounded storage, invalid/rotated keys never fall back
+    // to a cached key with different material. SecKey is immutable after import.
+    private static var cachedKey: (der: Data, key: SecKey)?
 
-    ///
-    /// Allows you to load an RSA public key (i.e. one downloaded from the net).
-    ///
     public static func load(rsaPublicKey: String) -> RSAPublicKey? {
-        // Clean up the key string
-        var pubKey: String = rsaPublicKey
-        pubKey = pubKey.replacingOccurrences(of: "-----BEGIN RSA PUBLIC KEY-----", with: "")
-        pubKey = pubKey.replacingOccurrences(of: "-----END RSA PUBLIC KEY-----", with: "")
-        pubKey = pubKey.replacingOccurrences(of: "-----BEGIN PUBLIC KEY-----", with: "")
-        pubKey = pubKey.replacingOccurrences(of: "-----END PUBLIC KEY-----", with: "")
-        pubKey = pubKey.replacingOccurrences(of: "\\n+", with: "", options: .regularExpression)
-        pubKey = pubKey.replacingOccurrences(of: "\n", with: "")
-        pubKey = pubKey.trimmingCharacters(in: .whitespacesAndNewlines)
-
-        do {
-            guard let rsaPublicKeyData: Data = Data(base64Encoded: String(pubKey)) else {
-                throw CustomError.cannotDecode
-            }
-
-            // Try parsing as PKCS#1
-            if let manualKey = ManualRSAPublicKey.fromPKCS1(rsaPublicKeyData) {
-                return RSAPublicKey(manualKey: manualKey)
-            }
-
-            // Most common public exponent is 65537 (0x010001)
-            let commonExponent = Data([0x01, 0x00, 0x01]) // 65537 in big-endian
-
-            // Assume the entire key data is the modulus
-            let lastResortKey = ManualRSAPublicKey(modulus: rsaPublicKeyData, exponent: commonExponent)
-            return RSAPublicKey(manualKey: lastResortKey)
-        } catch {
-            return nil
-        }
-    }
-}
-
-// Manual RSA Public Key Implementation using the BigInt library
-struct ManualRSAPublicKey {
-    let modulus: BigInt
-    let exponent: BigInt
-
-    init(modulus: Data, exponent: Data) {
-        // Create positive BigInts from Data
-        let modulusBytes = [UInt8](modulus)
-        var modulusValue = BigUInt(0)
-        for byte in modulusBytes {
-            modulusValue = (modulusValue << 8) | BigUInt(byte)
-        }
-        self.modulus = BigInt(modulusValue)
-        let exponentBytes = [UInt8](exponent)
-        var exponentValue = BigUInt(0)
-        for byte in exponentBytes {
-            exponentValue = (exponentValue << 8) | BigUInt(byte)
-        }
-        self.exponent = BigInt(exponentValue)
-    }
-
-    // Parse PKCS#1 format public key
-    static func fromPKCS1(_ publicKeyData: Data) -> ManualRSAPublicKey? {
-        // Parse ASN.1 DER encoded RSA public key
-        // Format: RSAPublicKey ::= SEQUENCE { modulus INTEGER, publicExponent INTEGER }
-
-        guard publicKeyData.count > 0 else {
-            return nil
-        }
-
-        let bytes = [UInt8](publicKeyData)
-
-        // Check for sequence tag (0x30)
-        guard bytes[0] == 0x30 else {
-            // Try direct modulus/exponent approach as fallback
-            if publicKeyData.count >= 3 {
-                // Assume this is a raw RSA public key with modulus + exponent
-                // Most common: modulus is 256 bytes (2048 bits), exponent is 3 bytes (0x010001 = 65537)
-                let modulusSize = publicKeyData.count - 3
-                if modulusSize > 0 {
-                    let modulusData = publicKeyData.prefix(modulusSize)
-                    let exponentData = publicKeyData.suffix(3)
-                    return ManualRSAPublicKey(modulus: modulusData, exponent: exponentData)
-                }
-            }
-
-            return nil
-        }
-
-        var index = 1
-
-        // Skip length
-        if bytes[index] & 0x80 != 0 {
-            let lenBytes = Int(bytes[index] & 0x7F)
-            if (index + 1 + lenBytes) >= bytes.count {
-                return nil
-            }
-            index += 1 + lenBytes
-        } else {
-            index += 1
-        }
-
-        // Check for INTEGER tag for modulus (0x02)
-        if index >= bytes.count {
-            return nil
-        }
-
-        guard bytes[index] == 0x02 else {
-            return nil
-        }
-        index += 1
-
-        // Get modulus length
-        if index >= bytes.count {
-            return nil
-        }
-
-        var modulusLength = 0
-        if bytes[index] & 0x80 != 0 {
-            let lenBytes = Int(bytes[index] & 0x7F)
-            if (index + 1 + lenBytes) >= bytes.count {
-                return nil
-            }
-            index += 1
-            for i in 0..<lenBytes {
-                modulusLength = (modulusLength << 8) | Int(bytes[index + i])
-            }
-            index += lenBytes
-        } else {
-            modulusLength = Int(bytes[index])
-            index += 1
-        }
-
-        // Skip any leading zero in modulus (for unsigned integer)
-        if index < bytes.count && bytes[index] == 0x00 {
-            index += 1
-            modulusLength -= 1
-        }
-
-        // Extract modulus
-        if (index + modulusLength) > bytes.count {
-            return nil
-        }
-
-        let modulusData = Data(bytes[index..<(index + modulusLength)])
-        index += modulusLength
-
-        // Check for INTEGER tag for exponent
-        if index >= bytes.count {
+        guard let der = pemToDer(rsaPublicKey) else {
+            os_log("RSA key import failed: invalid PEM/base64", log: Self.log, type: .error)
             return nil
         }
 
-        guard bytes[index] == 0x02 else {
+        keyLock.lock()
+        defer { keyLock.unlock() }
+        if let cached = cachedKey, cached.der == der {
+            return RSAPublicKey(key: cached.key)
+        }
+
+        let attributes: [CFString: Any] = [
+            kSecAttrKeyType: kSecAttrKeyTypeRSA,
+            kSecAttrKeyClass: kSecAttrKeyClassPublic
+        ]
+        var error: Unmanaged<CFError>?
+        guard let key = SecKeyCreateWithData(der as CFData, attributes as CFDictionary, &error) else {
+            os_log(
+                "RSA key import failed: %{public}@",
+                log: Self.log,
+                type: .error,
+                String(describing: error?.takeRetainedValue())
+            )
             return nil
         }
-        index += 1
-
-        // Get exponent length
-        if index >= bytes.count {
+        guard CapgoRawRsa.supportsCapgoRecovery(key: key) else {
+            os_log(
+                "RSA key import failed: unsupported key (Capgo requires RSA-2048 with raw encryption)",
+                log: Self.log,
+                type: .error
+            )
             return nil
         }
+        cachedKey = (der, key)
+        return RSAPublicKey(key: key)
+    }
 
-        var exponentLength = 0
-        if bytes[index] & 0x80 != 0 {
-            let lenBytes = Int(bytes[index] & 0x7F)
-            if (index + 1 + lenBytes) >= bytes.count {
-                return nil
-            }
-            index += 1
-            for i in 0..<lenBytes {
-                exponentLength = (exponentLength << 8) | Int(bytes[index + i])
-            }
-            index += lenBytes
-        } else {
-            exponentLength = Int(bytes[index])
-            index += 1
-        }
-
-        // Extract exponent
-        if (index + exponentLength) > bytes.count {
+    public func decrypt(data: Data) -> Data? {
+        let blockSize = SecKeyGetBlockSize(key)
+        guard data.count == blockSize else { return nil }
+        // Raw public-key encryption is the same c^e mod n operation as Node's
+        // publicDecrypt. Do NOT use encryption PKCS#1 padding here: the recovered
+        // block already contains signature (type-1) padding, checked below.
+        guard let recovered = CapgoRawRsa.recoverSignatureBlock(key: key, data: data) else {
             return nil
         }
-
-        let exponentData = Data(bytes[index..<(index + exponentLength)])
-        return ManualRSAPublicKey(modulus: modulusData, exponent: exponentData)
+        return Self.unpadSignature(recovered, blockSize: blockSize)
     }
 
-    // Decrypt data using raw RSA operation (c^d mod n)
-    func decrypt(_ encryptedData: Data) -> Data? {
-        // Create positive BigInt from encrypted data
-        let encryptedBytes = [UInt8](encryptedData)
-        var encryptedValue = BigUInt(0)
-        for byte in encryptedBytes {
-            encryptedValue = (encryptedValue << 8) | BigUInt(byte)
+    static func unpadSignature(_ block: Data, blockSize: Int = 256) -> Data? {
+        let bytes = [UInt8](block)
+        // RFC 8017: 00 01, at least eight FF bytes, 00, then the payload.
+        guard bytes.count == blockSize, bytes[0] == 0, bytes[1] == 1 else { return nil }
+        var separator = 2
+        while separator < bytes.count && bytes[separator] == 0xff {
+            separator += 1
         }
-        let encrypted = BigInt(encryptedValue)
-
-        // In Node.js:
-        // privateEncrypt uses the private key (d) to encrypt
-        // publicDecrypt uses the public key (e) to decrypt
-        // The operation we want is: ciphertext^e mod n
-
-        // RSA operation: c^e mod n
-        let decrypted = encrypted.manualPower(exponent, modulus: modulus)
-
-        // Convert to bytes with proper padding
-        guard let bigUIntValue = decrypted.magnitude as? BigUInt else {
+        guard separator >= 10, separator < bytes.count - 1, bytes[separator] == 0 else {
             return nil
         }
+        return Data(bytes[(separator + 1)...])
+    }
 
-        // Convert BigUInt to bytes with padding
-        var resultBytes = [UInt8]()
-        var tempValue = bigUIntValue
-        while tempValue > 0 {
-            let byte = UInt8(tempValue & 0xFF)
-            resultBytes.insert(byte, at: 0)  // Prepend to get big-endian
-            tempValue >>= 8
-        }
-
-        // Ensure we have at least 256 bytes (2048 bits) with leading zeros
-        let paddedBytes = [UInt8](repeating: 0, count: max(0, 256 - resultBytes.count)) + resultBytes
-
-        // For PKCS1 padding from Node.js privateEncrypt, the format is:
-        // 0x00 || 0x01 || PS || 0x00 || actual data
-        // where PS is a string of 0xFF bytes
-
-        // Check for privateEncrypt padding format (0x00 || 0x01 || PS || 0x00)
-        var startIndex = 0
-        if paddedBytes.count > 2 && paddedBytes[0] == 0x00 && paddedBytes[1] == 0x01 {
-            for i in 2..<paddedBytes.count {
-                if paddedBytes[i] == 0x00 {
-                    startIndex = i + 1
-                    break
-                }
-            }
-        }
-        if startIndex < paddedBytes.count {
-            let result = Data(paddedBytes[startIndex...])
-            return result
-        } else {
-            return Data(paddedBytes)
-        }
+    private static func pemToDer(_ pem: String) -> Data? {
+        let encoded = pem
+            .replacingOccurrences(of: "-----BEGIN RSA PUBLIC KEY-----", with: "")
+            .replacingOccurrences(of: "-----END RSA PUBLIC KEY-----", with: "")
+            .replacingOccurrences(of: "-----BEGIN PUBLIC KEY-----", with: "")
+            .replacingOccurrences(of: "-----END PUBLIC KEY-----", with: "")
+            .replacingOccurrences(of: "\\n", with: "")
+            .components(separatedBy: .whitespacesAndNewlines).joined()
+        return Data(base64Encoded: encoded)
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capgo/capacitor-updater",
-  "version": "8.51.15",
+  "version": "8.51.17",
   "license": "MPL-2.0",
   "description": "Live update for capacitor apps",
   "main": "dist/plugin.cjs.js",
@@ -72,6 +72,7 @@
     "watch": "tsc --watch",
     "prepublishOnly": "bun run build",
     "check:wiring": "node scripts/check-capacitor-plugin-wiring.mjs",
+    "check:cap9-deprecated": "bun scripts/check-cap9-deprecated.mjs",
     "changelog:ai": "node scripts/generate-ai-changelog.mjs",
     "example:install": "cd example-app && bun install --frozen-lockfile",
     "example:build": "bun run build && cd example-app && bun install --frozen-lockfile && bun run build",
@@ -89,7 +90,7 @@
     "@ionic/eslint-config": "^0.4.0",
     "@ionic/prettier-config": "^4.0.0",
     "@ionic/swiftlint-config": "^2.0.0",
-    "@types/node": "^24.3.0",
+    "@types/node": "^26.0.0",
     "eslint": "^8.57.0",
     "eslint-plugin-import": "^2.32.0",
     "husky": "^9.1.7",

package/ios/Sources/CapacitorUpdaterPlugin/BigInt.swift

@@ -1,39 +0,0 @@
-import BigInt
-
-// Add this custom power function to ensure safer handling of power operations
-
-// Manual exponentiation using the square-and-multiply algorithm
-// which is more efficient and avoids using the built-in functions that might handle BigInt differently
-extension BigInt {
-    func manualPower(_ exponent: BigInt, modulus: BigInt) -> BigInt {
-        // Quick checks
-        if modulus == 0 {
-            return 0
-        }
-
-        if exponent == 0 {
-            return 1
-        }
-
-        guard let base = self.magnitude as? BigUInt,
-              let exp = exponent.magnitude as? BigUInt,
-              let mod = modulus.magnitude as? BigUInt else {
-            return 0
-        }
-
-        // Square and multiply algorithm for modular exponentiation
-        var result = BigUInt(1)
-        var currentBase = base % mod
-        var currentExp = exp
-
-        while currentExp > 0 {
-            if currentExp & 1 == 1 {
-                result = (result * currentBase) % mod
-            }
-            currentBase = (currentBase * currentBase) % mod
-            currentExp >>= 1
-        }
-
-        return BigInt(result)
-    }
-}