expo-constants 58.0.2 → 58.0.4

package/CHANGELOG.md

@@ -10,6 +10,18 @@
 
 ### 💡 Others
 
+## 58.0.4 — 2026-09-21
+
+### 🎉 New features
+
+- Embed the project fingerprint (`app.fingerprint`) in debug builds, next to the embedded app config. ([#49905](https://github.com/expo/expo/pull/49905) by [@vonovak](https://github.com/vonovak))
+
+## 58.0.3 — 2026-09-16
+
+### 💡 Others
+
+- [iOS] Ship `PrivacyInfo.xcprivacy` from the `EXConstants` target so apps built with Swift Package Manager carry the privacy manifest, as CocoaPods builds already do. ([#49823](https://github.com/expo/expo/pull/49823) by [@chrfalch](https://github.com/chrfalch))
+
 ## 58.0.2 — 2026-09-15
 
 _This version does not introduce any user-facing changes._

package/Package.swift

@@ -21,7 +21,11 @@ let package = Package(
     .target(
       name: "EXConstants",
       dependencies: [],
-      path: "ios/EXConstants"
+      path: "ios/EXConstants",
+      // `.copy`, not `.process`: Apple reads a privacy manifest by its exact name, and
+      // .process may rename or transform what it puts in the bundle. The file stays in
+      // ios/ so the podspec keeps shipping it as the ExpoConstants_privacy bundle.
+      resources: [.copy("../PrivacyInfo.xcprivacy")]
     ),
     .target(
       name: "EXConstantsObjC",

package/android/build.gradle

@@ -6,7 +6,7 @@ plugins {
 apply from: "../scripts/get-app-config-android.gradle"
 
 group = 'host.exp.exponent'
-version = '58.0.2'
+version = '58.0.4'
 
 expoModule {
   // We can't prebuild the module because we need to apply `get-app-config-android.gradle` script.
@@ -17,6 +17,6 @@ android {
   namespace "expo.modules.constants"
   defaultConfig {
     versionCode 33
-    versionName "58.0.2"
+    versionName "58.0.4"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-constants",
-  "version": "58.0.2",
+  "version": "58.0.4",
   "description": "Provides system information that remains constant throughout the lifetime of your app.",
   "keywords": [
     "constants",
@@ -47,19 +47,20 @@
     ]
   },
   "dependencies": {
-    "@expo/env": "~2.5.0"
+    "@expo/env": "~2.5.0",
+    "@expo/require-utils": "^58.0.1"
   },
   "devDependencies": {
     "@types/node": "^22.14.0",
     "expo-manifests": "58.0.0",
     "expo-module-scripts": "56.0.3",
-    "expo-updates": "58.0.4"
+    "expo-updates": "58.0.6"
   },
   "peerDependencies": {
     "expo": "*",
     "react-native": "*"
   },
-  "gitHead": "313e67f5c9dfb16f9deca74a271cd1d4f33a6f82",
+  "gitHead": "ebb1fd7569c9c9e172cb9abd73dfede027c1d674",
   "scripts": {
     "build": "expo-build src",
     "clean": "expo-module clean",

package/scripts/createFingerprintFile.js

@@ -0,0 +1,110 @@
+// @ts-check
+/// <reference types="node" />
+
+const { resolveFrom } = require('@expo/require-utils');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { resolveProjectRoot } = require('./resolveProjectRoot');
+
+const FINGERPRINT_FILE_NAME = 'app.fingerprint';
+
+/**
+ * Write the project fingerprint to `app.fingerprint`, next to `app.config`.
+ *
+ * The options must match the reader's (`src/project/fingerprint.ts` in expo/expo-agent-cli).
+ * Never rejects: the fingerprint is optional metadata, so a failure is warned and the build goes on.
+ *
+ * @param {string} projectRoot
+ * @param {string} destinationDir
+ * @param {string | undefined} platform
+ * @param {boolean} enabled false for non-debug builds; the stale file is still removed
+ * @returns {Promise<string | null>} path of the written file, or null when skipped or failed
+ */
+async function createFingerprintFileAsync(projectRoot, destinationDir, platform, enabled) {
+  try {
+    return await writeFingerprintFileAsync(projectRoot, destinationDir, platform, enabled);
+  } catch (error) {
+    warnFingerprintEmbedFailed(/** @type {Error} */ (error));
+    return null;
+  }
+}
+
+/** @type {typeof createFingerprintFileAsync} */
+async function writeFingerprintFileAsync(projectRoot, destinationDir, platform, enabled) {
+  // No platform means the caller is not managing fingerprints — `@expo/cli`'s rebundle path asks
+  // for the app config alone — and clearing the file would strip it out of an app already built.
+  if (platform === undefined) {
+    return null;
+  }
+
+  // Cleared before the opt-out tests, not after: the iOS destination directory persists across
+  // builds, so a release build or an opted-out one has to remove what a debug build left.
+  const filePath = path.join(destinationDir, FINGERPRINT_FILE_NAME);
+  await fs.promises.rm(filePath, { force: true });
+
+  const skip =
+    !enabled || isFingerprintEmbeddingDisabled() || (platform !== 'ios' && platform !== 'android');
+  if (skip) {
+    return null;
+  }
+
+  // From the project root: a module-relative require could load another copy in a hoisted monorepo.
+  const fingerprintPath = resolveFrom(projectRoot, 'expo/fingerprint');
+  if (!fingerprintPath) {
+    return null;
+  }
+  const Fingerprint = require(fingerprintPath);
+
+  const fingerprint = await Fingerprint.createFingerprintAsync(projectRoot, {
+    platforms: [platform],
+    silent: true,
+  });
+  if (!fingerprint?.hash) {
+    return null;
+  }
+
+  const contents = { ...fingerprint, fingerprintVersion: readFingerprintVersion(fingerprintPath) };
+  await fs.promises.writeFile(filePath, JSON.stringify(contents));
+  return filePath;
+}
+
+/** @param {string} fingerprintPath */
+function readFingerprintVersion(fingerprintPath) {
+  const packagePath = resolveFrom(path.dirname(fingerprintPath), '@expo/fingerprint/package.json');
+  if (!packagePath) {
+    return null;
+  }
+  try {
+    return require(packagePath).version ?? null;
+  } catch {
+    return null;
+  }
+}
+
+function isFingerprintEmbeddingDisabled() {
+  const value = process.env.EXPO_SKIP_FINGERPRINT_EMBED;
+  return value != null && !['0', 'false', ''].includes(value.toLowerCase());
+}
+
+/** @param {Error} error */
+function warnFingerprintEmbedFailed(error) {
+  console.warn(
+    `Could not embed the project fingerprint (app.fingerprint): ${error.message}. ` +
+      `The build continues normally, but \`npx @expo/agent-cli status --explain\` cannot tell whether this build matches the project until a build with an embedded fingerprint succeeds.`
+  );
+}
+
+module.exports = {
+  createFingerprintFileAsync,
+  FINGERPRINT_FILE_NAME,
+};
+
+// Direct invocation from the Android build, whose task only exists for debuggable variants — hence
+// the hardcoded `enabled`.
+if (require.main === module) {
+  (async () => {
+    const projectRoot = resolveProjectRoot(process.argv[2] ?? process.cwd());
+    await createFingerprintFileAsync(projectRoot, process.argv[3], process.argv[4], true);
+  })();
+}

package/scripts/get-app-config-android.gradle

@@ -37,13 +37,47 @@ afterEvaluate {
     // Switch to project root and generate the app config
     workingDir projectRoot
 
+    // The last argument turns the fingerprint embed off here: the task below owns it.
     if (Os.isFamily(Os.FAMILY_WINDOWS)) {
-      commandLine("cmd", "/c", *nodeExecutableAndArgs, "$expoConstantsDir/scripts/getAppConfig.js", projectRoot, assetsDir)
+      commandLine("cmd", "/c", *nodeExecutableAndArgs, "$expoConstantsDir/scripts/getAppConfig.js", projectRoot, assetsDir, "android", "false")
     } else {
-      commandLine(*nodeExecutableAndArgs, "$expoConstantsDir/scripts/getAppConfig.js", projectRoot, assetsDir)
+      commandLine(*nodeExecutableAndArgs, "$expoConstantsDir/scripts/getAppConfig.js", projectRoot, assetsDir, "android", "false")
     }
   }
 
   // Generate app.config at preBuild
   tasks.getByName('preBuild').dependsOn(currentCreateConfigTask)
+
+  def fingerprintAssetsDir = file("$buildDir/generated/assets/expo-constants-fingerprint")
+
+  // A second task because `createExpoConfig` publishes to `sourceSets.main` off the single
+  // `preBuild`, so its output reaches release too. The fingerprint must not.
+  def createFingerprintTask = tasks.register('createExpoFingerprint', Exec) {
+    description = 'expo-constants: Embed the project fingerprint (app.fingerprint) in debug builds.'
+
+    doFirst {
+      fingerprintAssetsDir.deleteDir()
+      fingerprintAssetsDir.mkdirs()
+    }
+
+    // The fingerprint hashes sources across the whole project, so always regenerate it
+    outputs.upToDateWhen { false }
+    outputs.dir fingerprintAssetsDir
+
+    workingDir projectRoot
+
+    if (Os.isFamily(Os.FAMILY_WINDOWS)) {
+      commandLine("cmd", "/c", *nodeExecutableAndArgs, "$expoConstantsDir/scripts/createFingerprintFile.js", projectRoot, fingerprintAssetsDir, "android")
+    } else {
+      commandLine(*nodeExecutableAndArgs, "$expoConstantsDir/scripts/createFingerprintFile.js", projectRoot, fingerprintAssetsDir, "android")
+    }
+  }
+
+  project.android.libraryVariants.all { variant ->
+    if (!variant.buildType.debuggable) {
+      return
+    }
+    variant.preBuildProvider.configure { it.dependsOn(createFingerprintTask) }
+    project.android.sourceSets.maybeCreate(variant.buildType.name).assets.srcDirs += fingerprintAssetsDir
+  }
 }

package/scripts/get-app-config-ios.sh

@@ -32,4 +32,8 @@ else
   exit 1
 fi
 
-"${EXPO_CONSTANTS_PACKAGE_DIR}/scripts/with-node.sh" "${EXPO_CONSTANTS_PACKAGE_DIR}/scripts/getAppConfig.js" "$PROJECT_ROOT" "$RESOURCE_DEST"
+# Debug builds only, by the same configuration test expo-updates uses. The `|| echo` keeps a
+# release build from tripping `set -e`.
+EMBED_FINGERPRINT=$([[ "$CONFIGURATION" == *Debug* ]] && echo true || echo false)
+
+"${EXPO_CONSTANTS_PACKAGE_DIR}/scripts/with-node.sh" "${EXPO_CONSTANTS_PACKAGE_DIR}/scripts/getAppConfig.js" "$PROJECT_ROOT" "$RESOURCE_DEST" "ios" "$EMBED_FINGERPRINT"

package/scripts/getAppConfig.js

@@ -5,29 +5,29 @@ const { getConfig } = require('expo/config');
 const fs = require('node:fs');
 const path = require('node:path');
 
+const { createFingerprintFileAsync } = require('./createFingerprintFile');
+const { resolveProjectRoot } = require('./resolveProjectRoot');
+
 const cwd = process.cwd();
 const possibleProjectRoot = process.argv[2] ?? cwd;
 const destinationDir = process.argv[3] ?? cwd;
+const platform = process.argv[4];
+// The native build scripts pass 'true' for debug builds only.
+const embedFingerprint = process.argv[5] === 'true';
+
+(async () => {
+  const projectRoot = resolveProjectRoot(possibleProjectRoot);
+
+  require('@expo/env').load(projectRoot);
+  process.chdir(projectRoot);
+
+  const { exp } = getConfig(projectRoot, {
+    isPublicConfig: true,
+    skipSDKVersionRequirement: true,
+  });
+
+  fs.writeFileSync(path.join(destinationDir, 'app.config'), JSON.stringify(exp));
 
-// TODO: Verify we can remove projectRoot validation, now that we no longer
-// support React Native <= 62
-let projectRoot;
-if (fs.existsSync(path.join(possibleProjectRoot, 'package.json'))) {
-  projectRoot = possibleProjectRoot;
-} else if (fs.existsSync(path.join(possibleProjectRoot, '..', 'package.json'))) {
-  projectRoot = path.resolve(possibleProjectRoot, '..');
-} else {
-  throw new Error(
-    `Unable to locate project (no package.json found) at path: ${possibleProjectRoot}`
-  );
-}
-
-require('@expo/env').load(projectRoot);
-process.chdir(projectRoot);
-
-const { exp } = getConfig(projectRoot, {
-  isPublicConfig: true,
-  skipSDKVersionRequirement: true,
-});
-
-fs.writeFileSync(path.join(destinationDir, 'app.config'), JSON.stringify(exp));
+  // Only the fingerprint is optional. A failure above this line must still fail the build.
+  await createFingerprintFileAsync(projectRoot, destinationDir, platform, embedFingerprint);
+})();

package/scripts/resolveProjectRoot.js

@@ -0,0 +1,32 @@
+// @ts-check
+/// <reference types="node" />
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+// TODO: Verify we can remove projectRoot validation, now that we no longer
+// support React Native <= 62
+/**
+ * Resolve the app root from the app directory or from `<project>/android`, which is what gradle
+ * passes as `rootProject.projectDir`.
+ *
+ * @param {string} possibleProjectRoot
+ * @returns {string}
+ */
+function resolveProjectRoot(possibleProjectRoot) {
+  const resolvedProjectRoot = path.resolve(possibleProjectRoot);
+  if (fs.existsSync(path.join(resolvedProjectRoot, 'package.json'))) {
+    return resolvedProjectRoot;
+  }
+
+  const parentProjectRoot = path.dirname(resolvedProjectRoot);
+  if (fs.existsSync(path.join(parentProjectRoot, 'package.json'))) {
+    return parentProjectRoot;
+  }
+
+  throw new Error(
+    `Unable to locate project (no package.json found) at path: ${possibleProjectRoot}`
+  );
+}
+
+module.exports = { resolveProjectRoot };

package/.npmignore

@@ -1,24 +0,0 @@
-# @generated by expo-module-scripts
-
-# Exclude all top-level hidden directories by convention
-/.*/
-
-# Exclude tarballs generated by `npm pack`
-/*.tgz
-
-__mocks__
-__tests__
-__rsc_tests__
-
-/e2e
-/e2e-cli
-/babel.config.js
-/oxlint.config.mjs
-/android/src/androidTest/
-/android/src/test/
-/ios/Tests
-
-# Exclude native build output (pnpm pack ignores nested .gitignore files)
-.cxx/
-.gradle/
-/android/build/

package/.tsbuildinfo

@@ -1 +0,0 @@
-{"version":"6.0.3"}

package/android/.gitignore

@@ -1,261 +0,0 @@
-
-# Created by https://www.gitignore.io/api/java,maven,gradle,android,intellij,androidstudio
-
-### Android ###
-# Built application files
-*.apk
-*.ap_
-
-# Files for the ART/Dalvik VM
-*.dex
-
-# Java class files
-*.class
-
-# Generated files
-bin/
-gen/
-out/
-
-# Gradle files
-.gradle/
-build/
-
-# Local configuration file (sdk path, etc)
-local.properties
-
-# Proguard folder generated by Eclipse
-proguard/
-
-# Log Files
-*.log
-
-# Android Studio Navigation editor temp files
-.navigation/
-
-# Android Studio captures folder
-captures/
-
-# Intellij
-*.iml
-.idea/workspace.xml
-.idea/tasks.xml
-.idea/gradle.xml
-.idea/dictionaries
-.idea/libraries
-
-# External native build folder generated in Android Studio 2.2 and later
-.externalNativeBuild
-
-# Freeline
-freeline.py
-freeline/
-freeline_project_description.json
-
-### Android Patch ###
-gen-external-apklibs
-
-### AndroidStudio ###
-# Covers files to be ignored for android development using Android Studio.
-
-# Built application files
-
-# Files for the ART/Dalvik VM
-
-# Java class files
-
-# Generated files
-
-# Gradle files
-.gradle
-
-# Signing files
-.signing/
-
-# Local configuration file (sdk path, etc)
-
-# Proguard folder generated by Eclipse
-
-# Log Files
-
-# Android Studio
-/*/build/
-/*/local.properties
-/*/out
-/*/*/build
-/*/*/production
-*.ipr
-*~
-*.swp
-
-# Android Patch
-
-# External native build folder generated in Android Studio 2.2 and later
-
-# NDK
-obj/
-
-# IntelliJ IDEA
-*.iws
-/out/
-
-# User-specific configurations
-.idea/libraries/
-.idea/.name
-.idea/compiler.xml
-.idea/copyright/profiles_settings.xml
-.idea/encodings.xml
-.idea/misc.xml
-.idea/modules.xml
-.idea/scopes/scope_settings.xml
-.idea/vcs.xml
-.idea/jsLibraryMappings.xml
-.idea/datasources.xml
-.idea/dataSources.ids
-.idea/sqlDataSources.xml
-.idea/dynamic.xml
-.idea/uiDesigner.xml
-
-# OS-specific files
-.DS_Store
-.DS_Store?
-._*
-.Spotlight-V100
-.Trashes
-ehthumbs.db
-Thumbs.db
-
-# Legacy Eclipse project files
-.classpath
-.project
-.cproject
-.settings/
-
-# Mobile Tools for Java (J2ME)
-.mtj.tmp/
-
-# Package Files #
-*.war
-*.ear
-
-# virtual machine crash logs (Reference: http://www.java.com/en/download/help/error_hotspot.xml)
-hs_err_pid*
-
-## Plugin-specific files:
-
-# mpeltonen/sbt-idea plugin
-.idea_modules/
-
-# JIRA plugin
-atlassian-ide-plugin.xml
-
-# Mongo Explorer plugin
-.idea/mongoSettings.xml
-
-### AndroidStudio Patch ###
-
-!/gradle/wrapper/gradle-wrapper.jar
-
-### Intellij ###
-# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and Webstorm
-# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
-
-# User-specific stuff:
-.idea/**/workspace.xml
-.idea/**/tasks.xml
-
-# Sensitive or high-churn files:
-.idea/**/dataSources/
-.idea/**/dataSources.ids
-.idea/**/dataSources.xml
-.idea/**/dataSources.local.xml
-.idea/**/sqlDataSources.xml
-.idea/**/dynamic.xml
-.idea/**/uiDesigner.xml
-
-# Gradle:
-.idea/**/gradle.xml
-.idea/**/libraries
-
-# CMake
-cmake-build-debug/
-
-# Mongo Explorer plugin:
-.idea/**/mongoSettings.xml
-
-## File-based project format:
-
-## Plugin-specific files:
-
-# IntelliJ
-
-# mpeltonen/sbt-idea plugin
-
-# JIRA plugin
-
-# Cursive Clojure plugin
-.idea/replstate.xml
-
-# Ruby plugin and RubyMine
-/.rakeTasks
-
-### Intellij Patch ###
-# Comment Reason: https://github.com/joeblau/gitignore.io/issues/186#issuecomment-215987721
-
-# *.iml
-# modules.xml
-# .idea/misc.xml
-# *.ipr
-
-# Sonarlint plugin
-.idea/sonarlint
-
-### Java ###
-# Compiled class file
-
-# Log file
-
-# BlueJ files
-*.ctxt
-
-# Mobile Tools for Java (J2ME)
-
-# Package Files #
-*.jar
-*.zip
-*.tar.gz
-*.rar
-
-# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
-
-### Maven ###
-target/
-pom.xml.tag
-pom.xml.releaseBackup
-pom.xml.versionsBackup
-pom.xml.next
-release.properties
-dependency-reduced-pom.xml
-buildNumber.properties
-.mvn/timing.properties
-
-# Avoid ignoring Maven wrapper jar file (.jar files are usually ignored)
-!/.mvn/wrapper/maven-wrapper.jar
-
-### Gradle ###
-**/build/
-
-# Ignore Gradle GUI config
-gradle-app.setting
-
-# Avoid ignoring Gradle wrapper jar file (.jar files are usually ignored)
-!gradle-wrapper.jar
-
-# Cache of project
-.gradletasknamecache
-
-# # Work around https://youtrack.jetbrains.com/issue/IDEA-116898
-# gradle/wrapper/gradle-wrapper.properties
-
-
-# End of https://www.gitignore.io/api/java,maven,gradle,android,intellij,androidstudio

package/jest.config.js

@@ -1,3 +0,0 @@
-module.exports = require('expo-module-scripts/createCompositeJestPreset')(__dirname, [], {
-  rsc: true,
-});

package/scripts/tsconfig.tsbuildinfo

@@ -1 +0,0 @@
-{"root":["./src/getappconfig.ts"],"version":"5.9.2"}

package/tsconfig.json

@@ -1,9 +0,0 @@
-// @generated by expo-module-scripts
-{
-  "extends": "expo-module-scripts/tsconfig.base",
-  "compilerOptions": {
-    "rootDir": "./src",
-    "noEmit": true
-  },
-  "include": ["./src"]
-}