expo-constants 58.0.3 → 58.0.4

package/CHANGELOG.md

@@ -10,6 +10,12 @@
 
 ### 💡 Others
 
+## 58.0.4 — 2026-09-21
+
+### 🎉 New features
+
+- Embed the project fingerprint (`app.fingerprint`) in debug builds, next to the embedded app config. ([#49905](https://github.com/expo/expo/pull/49905) by [@vonovak](https://github.com/vonovak))
+
 ## 58.0.3 — 2026-09-16
 
 ### 💡 Others

package/android/build.gradle

@@ -6,7 +6,7 @@ plugins {
 apply from: "../scripts/get-app-config-android.gradle"
 
 group = 'host.exp.exponent'
-version = '58.0.3'
+version = '58.0.4'
 
 expoModule {
   // We can't prebuild the module because we need to apply `get-app-config-android.gradle` script.
@@ -17,6 +17,6 @@ android {
   namespace "expo.modules.constants"
   defaultConfig {
     versionCode 33
-    versionName "58.0.3"
+    versionName "58.0.4"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-constants",
-  "version": "58.0.3",
+  "version": "58.0.4",
   "description": "Provides system information that remains constant throughout the lifetime of your app.",
   "keywords": [
     "constants",
@@ -47,19 +47,20 @@
     ]
   },
   "dependencies": {
-    "@expo/env": "~2.5.0"
+    "@expo/env": "~2.5.0",
+    "@expo/require-utils": "^58.0.1"
   },
   "devDependencies": {
     "@types/node": "^22.14.0",
     "expo-manifests": "58.0.0",
     "expo-module-scripts": "56.0.3",
-    "expo-updates": "58.0.5"
+    "expo-updates": "58.0.6"
   },
   "peerDependencies": {
     "expo": "*",
     "react-native": "*"
   },
-  "gitHead": "917a61b581baeb852aa4fe331da2c1395d824351",
+  "gitHead": "ebb1fd7569c9c9e172cb9abd73dfede027c1d674",
   "scripts": {
     "build": "expo-build src",
     "clean": "expo-module clean",

package/scripts/createFingerprintFile.js

@@ -0,0 +1,110 @@
+// @ts-check
+/// <reference types="node" />
+
+const { resolveFrom } = require('@expo/require-utils');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { resolveProjectRoot } = require('./resolveProjectRoot');
+
+const FINGERPRINT_FILE_NAME = 'app.fingerprint';
+
+/**
+ * Write the project fingerprint to `app.fingerprint`, next to `app.config`.
+ *
+ * The options must match the reader's (`src/project/fingerprint.ts` in expo/expo-agent-cli).
+ * Never rejects: the fingerprint is optional metadata, so a failure is warned and the build goes on.
+ *
+ * @param {string} projectRoot
+ * @param {string} destinationDir
+ * @param {string | undefined} platform
+ * @param {boolean} enabled false for non-debug builds; the stale file is still removed
+ * @returns {Promise<string | null>} path of the written file, or null when skipped or failed
+ */
+async function createFingerprintFileAsync(projectRoot, destinationDir, platform, enabled) {
+  try {
+    return await writeFingerprintFileAsync(projectRoot, destinationDir, platform, enabled);
+  } catch (error) {
+    warnFingerprintEmbedFailed(/** @type {Error} */ (error));
+    return null;
+  }
+}
+
+/** @type {typeof createFingerprintFileAsync} */
+async function writeFingerprintFileAsync(projectRoot, destinationDir, platform, enabled) {
+  // No platform means the caller is not managing fingerprints — `@expo/cli`'s rebundle path asks
+  // for the app config alone — and clearing the file would strip it out of an app already built.
+  if (platform === undefined) {
+    return null;
+  }
+
+  // Cleared before the opt-out tests, not after: the iOS destination directory persists across
+  // builds, so a release build or an opted-out one has to remove what a debug build left.
+  const filePath = path.join(destinationDir, FINGERPRINT_FILE_NAME);
+  await fs.promises.rm(filePath, { force: true });
+
+  const skip =
+    !enabled || isFingerprintEmbeddingDisabled() || (platform !== 'ios' && platform !== 'android');
+  if (skip) {
+    return null;
+  }
+
+  // From the project root: a module-relative require could load another copy in a hoisted monorepo.
+  const fingerprintPath = resolveFrom(projectRoot, 'expo/fingerprint');
+  if (!fingerprintPath) {
+    return null;
+  }
+  const Fingerprint = require(fingerprintPath);
+
+  const fingerprint = await Fingerprint.createFingerprintAsync(projectRoot, {
+    platforms: [platform],
+    silent: true,
+  });
+  if (!fingerprint?.hash) {
+    return null;
+  }
+
+  const contents = { ...fingerprint, fingerprintVersion: readFingerprintVersion(fingerprintPath) };
+  await fs.promises.writeFile(filePath, JSON.stringify(contents));
+  return filePath;
+}
+
+/** @param {string} fingerprintPath */
+function readFingerprintVersion(fingerprintPath) {
+  const packagePath = resolveFrom(path.dirname(fingerprintPath), '@expo/fingerprint/package.json');
+  if (!packagePath) {
+    return null;
+  }
+  try {
+    return require(packagePath).version ?? null;
+  } catch {
+    return null;
+  }
+}
+
+function isFingerprintEmbeddingDisabled() {
+  const value = process.env.EXPO_SKIP_FINGERPRINT_EMBED;
+  return value != null && !['0', 'false', ''].includes(value.toLowerCase());
+}
+
+/** @param {Error} error */
+function warnFingerprintEmbedFailed(error) {
+  console.warn(
+    `Could not embed the project fingerprint (app.fingerprint): ${error.message}. ` +
+      `The build continues normally, but \`npx @expo/agent-cli status --explain\` cannot tell whether this build matches the project until a build with an embedded fingerprint succeeds.`
+  );
+}
+
+module.exports = {
+  createFingerprintFileAsync,
+  FINGERPRINT_FILE_NAME,
+};
+
+// Direct invocation from the Android build, whose task only exists for debuggable variants — hence
+// the hardcoded `enabled`.
+if (require.main === module) {
+  (async () => {
+    const projectRoot = resolveProjectRoot(process.argv[2] ?? process.cwd());
+    await createFingerprintFileAsync(projectRoot, process.argv[3], process.argv[4], true);
+  })();
+}

package/scripts/get-app-config-android.gradle

@@ -37,13 +37,47 @@ afterEvaluate {
     // Switch to project root and generate the app config
     workingDir projectRoot
 
+    // The last argument turns the fingerprint embed off here: the task below owns it.
     if (Os.isFamily(Os.FAMILY_WINDOWS)) {
-      commandLine("cmd", "/c", *nodeExecutableAndArgs, "$expoConstantsDir/scripts/getAppConfig.js", projectRoot, assetsDir)
+      commandLine("cmd", "/c", *nodeExecutableAndArgs, "$expoConstantsDir/scripts/getAppConfig.js", projectRoot, assetsDir, "android", "false")
     } else {
-      commandLine(*nodeExecutableAndArgs, "$expoConstantsDir/scripts/getAppConfig.js", projectRoot, assetsDir)
+      commandLine(*nodeExecutableAndArgs, "$expoConstantsDir/scripts/getAppConfig.js", projectRoot, assetsDir, "android", "false")
     }
   }
 
   // Generate app.config at preBuild
   tasks.getByName('preBuild').dependsOn(currentCreateConfigTask)
+
+  def fingerprintAssetsDir = file("$buildDir/generated/assets/expo-constants-fingerprint")
+
+  // A second task because `createExpoConfig` publishes to `sourceSets.main` off the single
+  // `preBuild`, so its output reaches release too. The fingerprint must not.
+  def createFingerprintTask = tasks.register('createExpoFingerprint', Exec) {
+    description = 'expo-constants: Embed the project fingerprint (app.fingerprint) in debug builds.'
+
+    doFirst {
+      fingerprintAssetsDir.deleteDir()
+      fingerprintAssetsDir.mkdirs()
+    }
+
+    // The fingerprint hashes sources across the whole project, so always regenerate it
+    outputs.upToDateWhen { false }
+    outputs.dir fingerprintAssetsDir
+
+    workingDir projectRoot
+
+    if (Os.isFamily(Os.FAMILY_WINDOWS)) {
+      commandLine("cmd", "/c", *nodeExecutableAndArgs, "$expoConstantsDir/scripts/createFingerprintFile.js", projectRoot, fingerprintAssetsDir, "android")
+    } else {
+      commandLine(*nodeExecutableAndArgs, "$expoConstantsDir/scripts/createFingerprintFile.js", projectRoot, fingerprintAssetsDir, "android")
+    }
+  }
+
+  project.android.libraryVariants.all { variant ->
+    if (!variant.buildType.debuggable) {
+      return
+    }
+    variant.preBuildProvider.configure { it.dependsOn(createFingerprintTask) }
+    project.android.sourceSets.maybeCreate(variant.buildType.name).assets.srcDirs += fingerprintAssetsDir
+  }
 }

package/scripts/get-app-config-ios.sh

@@ -32,4 +32,8 @@ else
   exit 1
 fi
 
-"${EXPO_CONSTANTS_PACKAGE_DIR}/scripts/with-node.sh" "${EXPO_CONSTANTS_PACKAGE_DIR}/scripts/getAppConfig.js" "$PROJECT_ROOT" "$RESOURCE_DEST"
+# Debug builds only, by the same configuration test expo-updates uses. The `|| echo` keeps a
+# release build from tripping `set -e`.
+EMBED_FINGERPRINT=$([[ "$CONFIGURATION" == *Debug* ]] && echo true || echo false)
+
+"${EXPO_CONSTANTS_PACKAGE_DIR}/scripts/with-node.sh" "${EXPO_CONSTANTS_PACKAGE_DIR}/scripts/getAppConfig.js" "$PROJECT_ROOT" "$RESOURCE_DEST" "ios" "$EMBED_FINGERPRINT"

package/scripts/getAppConfig.js

@@ -5,29 +5,29 @@ const { getConfig } = require('expo/config');
 const fs = require('node:fs');
 const path = require('node:path');
 
+const { createFingerprintFileAsync } = require('./createFingerprintFile');
+const { resolveProjectRoot } = require('./resolveProjectRoot');
+
 const cwd = process.cwd();
 const possibleProjectRoot = process.argv[2] ?? cwd;
 const destinationDir = process.argv[3] ?? cwd;
+const platform = process.argv[4];
+// The native build scripts pass 'true' for debug builds only.
+const embedFingerprint = process.argv[5] === 'true';
+
+(async () => {
+  const projectRoot = resolveProjectRoot(possibleProjectRoot);
+
+  require('@expo/env').load(projectRoot);
+  process.chdir(projectRoot);
+
+  const { exp } = getConfig(projectRoot, {
+    isPublicConfig: true,
+    skipSDKVersionRequirement: true,
+  });
+
+  fs.writeFileSync(path.join(destinationDir, 'app.config'), JSON.stringify(exp));
 
-// TODO: Verify we can remove projectRoot validation, now that we no longer
-// support React Native <= 62
-let projectRoot;
-if (fs.existsSync(path.join(possibleProjectRoot, 'package.json'))) {
-  projectRoot = possibleProjectRoot;
-} else if (fs.existsSync(path.join(possibleProjectRoot, '..', 'package.json'))) {
-  projectRoot = path.resolve(possibleProjectRoot, '..');
-} else {
-  throw new Error(
-    `Unable to locate project (no package.json found) at path: ${possibleProjectRoot}`
-  );
-}
-
-require('@expo/env').load(projectRoot);
-process.chdir(projectRoot);
-
-const { exp } = getConfig(projectRoot, {
-  isPublicConfig: true,
-  skipSDKVersionRequirement: true,
-});
-
-fs.writeFileSync(path.join(destinationDir, 'app.config'), JSON.stringify(exp));
+  // Only the fingerprint is optional. A failure above this line must still fail the build.
+  await createFingerprintFileAsync(projectRoot, destinationDir, platform, embedFingerprint);
+})();

package/scripts/resolveProjectRoot.js

@@ -0,0 +1,32 @@
+// @ts-check
+/// <reference types="node" />
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+// TODO: Verify we can remove projectRoot validation, now that we no longer
+// support React Native <= 62
+/**
+ * Resolve the app root from the app directory or from `<project>/android`, which is what gradle
+ * passes as `rootProject.projectDir`.
+ *
+ * @param {string} possibleProjectRoot
+ * @returns {string}
+ */
+function resolveProjectRoot(possibleProjectRoot) {
+  const resolvedProjectRoot = path.resolve(possibleProjectRoot);
+  if (fs.existsSync(path.join(resolvedProjectRoot, 'package.json'))) {
+    return resolvedProjectRoot;
+  }
+
+  const parentProjectRoot = path.dirname(resolvedProjectRoot);
+  if (fs.existsSync(path.join(parentProjectRoot, 'package.json'))) {
+    return parentProjectRoot;
+  }
+
+  throw new Error(
+    `Unable to locate project (no package.json found) at path: ${possibleProjectRoot}`
+  );
+}
+
+module.exports = { resolveProjectRoot };