@forthtilliath/expo-release-updates 0.8.0 → 0.9.0

package/README.md

@@ -76,12 +76,14 @@ if (release && isUpdateAvailable(currentVersion, release.version)) {
 }
 ```
 
-### `fetchLatestRelease({ owner, repo, includePrereleases?, token?, timeoutMs?, signal? })`
+### `fetchLatestRelease({ owner, repo, includePrereleases?, requireVerifiedApk?, token?, timeoutMs?, signal? })`
 
 Fetches the latest GitHub release and its `.apk` asset: `{ version, notes, apkUrl, apkSha256? }`. `apkSha256` is the SHA-256 GitHub computed when the APK was uploaded — pass it to `downloadAndInstallApk`'s `expectedSha256`. Returns `null` if the latest release has no `.apk` attached; throws if the GitHub API request fails. Pass `token` for private repos, or to raise the API rate limit from 60 to 5000 requests/hour on public ones.
 
 GitHub's `/releases/latest` only ever returns a **stable** release: an app that only publishes pre-releases (alpha, beta) would never see an update. Pass `includePrereleases: true` to scan the 10 most recent releases instead (drafts left out) and keep the highest version (semver, `1.0.0-alpha.10` > `1.0.0-alpha.2`) that carries an `.apk`.
 
+Pass `requireVerifiedApk: true` to only consider an `.apk` that `downloadAndInstallApk` with `expectedSha256` and `allowedUrlPrefix: releaseDownloadUrlPrefix(...)` would accept: one with a SHA-256, under this repo's release URLs. A release whose APK fails either is skipped (with `includePrereleases`, the next highest version wins), so the app never offers an update the install would then refuse. Every field of GitHub's answer is type-checked and bounded: notes are cut at 100,000 characters, an oversized tag or URL counts as missing, and a release without a tag is ignored.
+
 The request gives up after `timeoutMs` (default `15000`) instead of hanging on a bad network, and can be cancelled with `signal` (an `AbortSignal`) — both also apply to `fetchReleaseHistory`.
 
 > **Security — the token ships inside your app.** Anything bundled in an APK can be extracted from it, so treat the token as public: use a [fine-grained token](https://github.com/settings/personal-access-tokens) with **read-only "Contents" access to this one repository** and nothing else, never a classic token or one with write scopes. For a public repo, prefer no token at all.

package/dist/githubReleases.d.ts

@@ -37,6 +37,15 @@ export interface FetchLatestReleaseOptions extends GithubRepoRef {
      * wins. Defaults to `false`.
      */
     includePrereleases?: boolean;
+    /**
+     * Only consider an `.apk` the recommended install would accept: one with a
+     * SHA-256 (`apkSha256`, for `downloadAndInstallApk`'s `expectedSha256`)
+     * and a URL under `releaseDownloadUrlPrefix(options)` (its
+     * `allowedUrlPrefix`). A release whose APK fails either is skipped — with
+     * `includePrereleases`, the next highest version wins — so nothing is
+     * offered that the install would then refuse. Defaults to `false`.
+     */
+    requireVerifiedApk?: boolean;
 }
 export interface ReleaseHistoryEntry {
     version: string;

package/dist/githubReleases.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"githubReleases.d.ts","sourceRoot":"","sources":["../src/githubReleases.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAA0B,SAAQ,aAAa;IAC9D;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AA4BD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,aAAa,UAEtE;AAyFD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAyB/B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,aAAa,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAchC"}
+{"version":3,"file":"githubReleases.d.ts","sourceRoot":"","sources":["../src/githubReleases.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAA0B,SAAQ,aAAa;IAC9D;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAgCD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,aAAa,UAEtE;AAwGD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAyB/B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,aAAa,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAchC"}

package/dist/githubReleases.js

@@ -5,6 +5,10 @@ const MAX_PER_PAGE = 100;
 /** Enough to skip a few releases without an APK (notes only, drafts). */
 const PRERELEASE_SCAN = 10;
 const SHA256_DIGEST = /^sha256:([0-9a-f]{64})$/i;
+/** Release notes longer than this are cut: rendered as is, they'd stall the UI. */
+const MAX_NOTES_LENGTH = 100_000;
+/** Tags, asset names, URLs, dates: anything longer is treated as missing. */
+const MAX_FIELD_LENGTH = 2_048;
 function releasesUrl({ owner, repo }) {
     return `https://api.github.com/repos/${owner}/${repo}/releases`;
 }
@@ -17,7 +21,14 @@ export function releaseDownloadUrlPrefix({ owner, repo }) {
     return `https://github.com/${owner}/${repo}/releases/download/`;
 }
 function text(value) {
-    return typeof value === "string" ? value : "";
+    return typeof value === "string" && value.length <= MAX_FIELD_LENGTH
+        ? value
+        : "";
+}
+function notesOf(release) {
+    return typeof release.body === "string"
+        ? release.body.slice(0, MAX_NOTES_LENGTH)
+        : "";
 }
 function isObject(value) {
     return typeof value === "object" && value !== null;
@@ -28,25 +39,32 @@ function releasesIn(data) {
 function versionOf(release) {
     return text(release.tag_name).replace(/^v/, "");
 }
-function apkOf(release) {
+function apkOf(release, options) {
     const assets = Array.isArray(release.assets)
         ? release.assets.filter(isObject)
         : [];
-    const apk = assets.find((asset) => text(asset.name).endsWith(".apk") &&
-        text(asset.browser_download_url) !== "");
-    if (!apk)
-        return null;
-    const sha256 = SHA256_DIGEST.exec(text(apk.digest))?.[1]?.toLowerCase();
-    return {
-        apkUrl: text(apk.browser_download_url),
-        ...(sha256 ? { apkSha256: sha256 } : {}),
-    };
+    const prefix = releaseDownloadUrlPrefix(options);
+    for (const asset of assets) {
+        const apkUrl = text(asset.browser_download_url);
+        if (!text(asset.name).endsWith(".apk") || apkUrl === "")
+            continue;
+        const sha256 = SHA256_DIGEST.exec(text(asset.digest))?.[1]?.toLowerCase();
+        if (options.requireVerifiedApk && (!sha256 || !apkUrl.startsWith(prefix))) {
+            continue;
+        }
+        return { apkUrl, ...(sha256 ? { apkSha256: sha256 } : {}) };
+    }
+    return null;
 }
-function toLatestRelease(release) {
-    const apk = apkOf(release);
+function toLatestRelease(release, options) {
+    const version = versionOf(release);
+    // Without a tag, there's nothing to compare the installed version with.
+    if (version === "")
+        return null;
+    const apk = apkOf(release, options);
     if (!apk)
         return null;
-    return { version: versionOf(release), notes: text(release.body), ...apk };
+    return { version, notes: notesOf(release), ...apk };
 }
 function githubHeaders({ token }) {
     return {
@@ -106,14 +124,14 @@ async function fetchGithubJson(url, ref) {
 export async function fetchLatestRelease(options) {
     if (!options.includePrereleases) {
         const data = await fetchGithubJson(`${releasesUrl(options)}/latest`, options);
-        return isObject(data) ? toLatestRelease(data) : null;
+        return isObject(data) ? toLatestRelease(data, options) : null;
     }
     const data = await fetchGithubJson(`${releasesUrl(options)}?per_page=${String(PRERELEASE_SCAN)}`, options);
     let latest = null;
     for (const release of releasesIn(data)) {
         if (release.draft === true)
             continue;
-        const candidate = toLatestRelease(release);
+        const candidate = toLatestRelease(release, options);
         if (candidate &&
             (!latest || compareVersions(candidate.version, latest.version) > 0)) {
             latest = candidate;
@@ -134,7 +152,7 @@ export async function fetchReleaseHistory(ref) {
         .filter((release) => release.draft !== true)
         .map((release) => ({
         version: versionOf(release),
-        notes: text(release.body),
+        notes: notesOf(release),
         publishedAt: text(release.published_at),
     }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forthtilliath/expo-release-updates",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
@@ -34,17 +34,17 @@
     }
   },
   "dependencies": {
-    "@forthtilliath/ts-kit": "^0.14.0"
+    "@forthtilliath/ts-kit": "^0.15.0"
   },
   "devDependencies": {
-    "@vitest/coverage-v8": "5.0.2",
+    "@vitest/coverage-v8": "5.0.5",
     "eslint": "10.7.0",
     "expo-file-system": "~57.0.2",
     "expo-intent-launcher": "~57.0.1",
     "typescript": "^5.9.3",
-    "vitest": "^5.0.2",
-    "@forthtilliath/eslint-config": "0.9.0",
+    "vitest": "^5.0.5",
     "@forthtilliath/typescript-config": "0.1.1",
+    "@forthtilliath/eslint-config": "0.10.0",
     "@forthtilliath/test-kit": "0.4.0"
   },
   "scripts": {