expo-updates 29.0.17 → 29.0.18

package/CHANGELOG.md

@@ -10,6 +10,13 @@
 
 ### 💡 Others
 
+## 29.0.18 — 2026-05-28
+
+### 🐛 Bug fixes
+
+- [cli] Write private key into owner-only permissions file ([#45880](https://github.com/expo/expo/pull/45880) by [@kitten](https://github.com/kitten))
+- Prevent logging on download progress events to reduce log size. ([#42436](https://github.com/expo/expo/pull/42436) by [@alanjhughes](https://github.com/alanjhughes))
+
 ## 29.0.17 — 2026-04-27
 
 _This version does not introduce any user-facing changes._

package/android/build.gradle

@@ -42,7 +42,7 @@ expoModule {
 }
 
 group = 'host.exp.exponent'
-version = '29.0.17'
+version = '29.0.18'
 
 // Utility method to derive boolean values from the environment or from Java properties,
 // and return them as strings to be used in BuildConfig fields
@@ -88,7 +88,7 @@ android {
   namespace "expo.modules.updates"
   defaultConfig {
     versionCode 31
-    versionName '29.0.17'
+    versionName '29.0.18'
     consumerProguardFiles("proguard-rules.pro")
     testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
 

package/android/src/main/java/expo/modules/updates/statemachine/UpdatesStateMachine.kt

@@ -71,7 +71,9 @@ class UpdatesStateMachine(
   private fun processEvent(event: UpdatesStateEvent) {
     if (transition(event)) {
       context = reduceContext(context, event)
-      logger.info("Updates state change: ${event.type}, context = ${context.json}")
+      if (event !is UpdatesStateEvent.DownloadProgress) {
+        logger.info("Updates state change: ${event.type}, context = ${context.json}")
+      }
       sendContextToJS()
     }
   }

package/cli/build/generateCodeSigningAsync.js

@@ -35,7 +35,9 @@ async function generateCodeSigningAsync(projectRoot, { certificateValidityDurati
     const certificatePEM = (0, code_signing_certificates_1.convertCertificateToCertificatePEM)(certificate);
     await Promise.all([
         fs_1.promises.writeFile(path_1.default.join(keyOutputDir, 'public-key.pem'), keyPairPEM.publicKeyPEM),
-        fs_1.promises.writeFile(path_1.default.join(keyOutputDir, 'private-key.pem'), keyPairPEM.privateKeyPEM),
+        fs_1.promises.writeFile(path_1.default.join(keyOutputDir, 'private-key.pem'), keyPairPEM.privateKeyPEM, {
+            mode: 0o600,
+        }),
         fs_1.promises.writeFile(path_1.default.join(certificateOutputDir, 'certificate.pem'), certificatePEM),
     ]);
     (0, log_1.log)(`Generated public and private keys output in ${keyOutputDir}. Remember to add them to .gitignore or to encrypt them. (e.g. with git-crypt)`);

package/cli/src/generateCodeSigningAsync.ts

@@ -51,7 +51,9 @@ export async function generateCodeSigningAsync(
 
   await Promise.all([
     fs.writeFile(path.join(keyOutputDir, 'public-key.pem'), keyPairPEM.publicKeyPEM),
-    fs.writeFile(path.join(keyOutputDir, 'private-key.pem'), keyPairPEM.privateKeyPEM),
+    fs.writeFile(path.join(keyOutputDir, 'private-key.pem'), keyPairPEM.privateKeyPEM, {
+      mode: 0o600,
+    }),
     fs.writeFile(path.join(certificateOutputDir, 'certificate.pem'), certificatePEM),
   ]);
 

package/ios/EXUpdates/UpdatesStateMachine.swift

@@ -316,7 +316,9 @@ internal class UpdatesStateMachine {
     if transition(event) {
       // Only change context if transition succeeds
       context = reducedContext(context, event)
-      logger.info(message: "Updates state change: state = \(state), event = \(event.type), context = \(context)")
+      if event.type != .downloadProgress {
+        logger.info(message: "Updates state change: state = \(state), event = \(event.type), context = \(context)")
+      }
       sendContextToJS()
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-updates",
-  "version": "29.0.17",
+  "version": "29.0.18",
   "description": "Fetches and manages remotely-hosted assets and updates to your app's JS bundle.",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -39,7 +39,7 @@
   },
   "dependencies": {
     "@expo/code-signing-certificates": "^0.0.6",
-    "@expo/plist": "^0.4.8",
+    "@expo/plist": "^0.4.9",
     "@expo/spawn-async": "^1.7.2",
     "arg": "4.1.0",
     "chalk": "^4.1.2",
@@ -73,5 +73,5 @@
     "react": "*",
     "react-native": "*"
   },
-  "gitHead": "dd4e87727c4ef32ac5d8a7b5a42fd80da254140f"
+  "gitHead": "45c60e10956764bbac6c62454890eeb25c74bbd6"
 }