expo-updates 29.0.18 → 29.0.20

package/CHANGELOG.md

@@ -10,6 +10,23 @@
 
 ### 💡 Others
 
+## 29.0.20 — 2026-08-17
+
+### 🐛 Bug fixes
+
+- [iOS] Set `always_out_of_date` on the `Generate updates resources for expo-updates` script_phase to silence the Xcode "run script phase will run on every build" dependency-analysis warning. ([#47622](https://github.com/expo/expo/pull/47622) by [@ramonclaudio](https://github.com/ramonclaudio))
+- Reject updates whose asset key or file extension contains a path separator, which previously let a manifest write and delete files outside the updates directory. ([#48762](https://github.com/expo/expo/pull/48762), [#48763](https://github.com/expo/expo/pull/48763) by [@alanjhughes](https://github.com/alanjhughes))
+
+### 💡 Others
+
+- [iOS] Link `libc++` in the test spec so the unit test bundle resolves the C++ symbols it pulls from `ExpoModulesCore`. ([#48762](https://github.com/expo/expo/pull/48762) by [@alanjhughes](https://github.com/alanjhughes))
+
+## 29.0.19 — 2026-07-15
+
+### 💡 Others
+
+- [Internal] Align find-up `package.json` search utilities ([#47127](https://github.com/expo/expo/pull/47127) by [@kitten](https://github.com/kitten))
+
 ## 29.0.18 — 2026-05-28
 
 ### 🐛 Bug fixes

package/android/build.gradle

@@ -42,7 +42,7 @@ expoModule {
 }
 
 group = 'host.exp.exponent'
-version = '29.0.18'
+version = '29.0.20'
 
 // Utility method to derive boolean values from the environment or from Java properties,
 // and return them as strings to be used in BuildConfig fields
@@ -88,7 +88,7 @@ android {
   namespace "expo.modules.updates"
   defaultConfig {
     versionCode 31
-    versionName '29.0.18'
+    versionName '29.0.20'
     consumerProguardFiles("proguard-rules.pro")
     testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
 

package/android/src/main/java/expo/modules/updates/UpdatesUtils.kt

@@ -157,6 +157,17 @@ object UpdatesUtils {
     }
   }
 
+  /**
+   * Asset filenames are built from manifest-controlled values, so a filename holding a path
+   * separator or a `..` component would resolve outside the updates directory.
+   */
+  fun isSafeFilename(filename: String): Boolean {
+    return filename.isNotEmpty() &&
+      filename != "." &&
+      filename != ".." &&
+      filename.none { it == '/' || it == '\\' || it == '\u0000' }
+  }
+
   fun shouldCheckForUpdateOnLaunch(
     updatesConfiguration: UpdatesConfiguration,
     logger: UpdatesLogger,

package/android/src/main/java/expo/modules/updates/db/Reaper.kt

@@ -2,10 +2,12 @@ package expo.modules.updates.db
 
 import android.util.Log
 import expo.modules.updates.UpdatesConfiguration
+import expo.modules.updates.UpdatesUtils
 import expo.modules.updates.db.entity.AssetEntity
 import expo.modules.updates.db.entity.UpdateEntity
 import expo.modules.updates.manifest.ManifestMetadata
 import expo.modules.updates.selectionpolicy.SelectionPolicy
+import expo.modules.updates.utils.AndroidResourceAssetUtils
 import java.io.File
 
 /**
@@ -47,7 +49,20 @@ object Reaper {
         )
         continue
       }
-      val path = File(updatesDirectory, asset.relativePath)
+      val relativePath = asset.relativePath
+      // Embedded assets are served from the APK, so there is no file here to delete.
+      if (relativePath == null || AndroidResourceAssetUtils.isAndroidResourceAsset(relativePath)) {
+        continue
+      }
+      // A row written before asset filenames were validated may point outside the updates directory.
+      if (!UpdatesUtils.isSafeFilename(relativePath)) {
+        Log.e(
+          TAG,
+          "Refusing to delete asset with URL " + asset.url + " at unsafe path " + relativePath
+        )
+        continue
+      }
+      val path = File(updatesDirectory, relativePath)
       try {
         if (path.exists() && !path.delete()) {
           Log.e(TAG, "Failed to delete asset with URL " + asset.url + " at path " + path.toString())

package/android/src/main/java/expo/modules/updates/loader/FileDownloader.kt

@@ -353,6 +353,12 @@ class FileDownloader(
     }
 
     val filename = UpdatesUtils.createFilenameForAsset(asset)
+    if (!UpdatesUtils.isSafeFilename(filename)) {
+      val message = "Failed to download asset ${asset.key}"
+      val error = IOException("Asset filename \"$filename\" would resolve outside the updates directory")
+      logger.error(message, error, UpdatesErrorCode.AssetsFailedToLoad)
+      throw IOException(message, error)
+    }
     val path = File(destinationDirectory, filename)
 
     if (path.exists()) {

package/android/src/main/java/expo/modules/updates/manifest/ExpoUpdatesUpdate.kt

@@ -14,6 +14,7 @@ import expo.modules.updates.db.enums.UpdateStatus
 import org.json.JSONArray
 import org.json.JSONException
 import org.json.JSONObject
+import java.io.IOException
 import java.text.ParseException
 import java.util.*
 
@@ -95,27 +96,43 @@ class ExpoUpdatesUpdate private constructor(
   companion object {
     private val TAG = Update::class.java.simpleName
 
-    @Throws(JSONException::class)
+    @Throws(Exception::class)
     fun fromExpoUpdatesManifest(
       manifest: ExpoUpdatesManifest,
       extensions: JSONObject?,
       configuration: UpdatesConfiguration
-    ): ExpoUpdatesUpdate = ExpoUpdatesUpdate(
-      manifest,
-      id = UUID.fromString(manifest.getID()),
-      configuration.scopeKey,
-      commitTime = try {
-        UpdatesUtils.parseDateString(manifest.getCreatedAt())
-      } catch (e: ParseException) {
-        Log.e(TAG, "Could not parse manifest createdAt string; falling back to current time", e)
-        Date()
-      },
-      runtimeVersion = manifest.getRuntimeVersion(),
-      launchAsset = manifest.getLaunchAsset(),
-      assets = manifest.getAssets(),
-      extensions = extensions,
-      url = configuration.updateUrl,
-      requestHeaders = configuration.requestHeaders
-    )
+    ): ExpoUpdatesUpdate {
+      val update = ExpoUpdatesUpdate(
+        manifest,
+        id = UUID.fromString(manifest.getID()),
+        configuration.scopeKey,
+        commitTime = try {
+          UpdatesUtils.parseDateString(manifest.getCreatedAt())
+        } catch (e: ParseException) {
+          Log.e(TAG, "Could not parse manifest createdAt string; falling back to current time", e)
+          Date()
+        },
+        runtimeVersion = manifest.getRuntimeVersion(),
+        launchAsset = manifest.getLaunchAsset(),
+        assets = manifest.getAssets(),
+        extensions = extensions,
+        url = configuration.updateUrl,
+        requestHeaders = configuration.requestHeaders
+      )
+
+      update.assetEntityList.forEach { asset ->
+        val filename = UpdatesUtils.createFilenameForAsset(asset)
+        if (!UpdatesUtils.isSafeFilename(filename)) {
+          throw IOException(
+            "Update ${manifest.getID()} could not be loaded because the asset filename " +
+              "\"$filename\" is not a valid filename. Assets are stored under their key and file " +
+              "extension, so neither may contain a path separator. Check the server that produced " +
+              "this manifest."
+          )
+        }
+      }
+
+      return update
+    }
   }
 }

package/ios/EXUpdates/AppLauncher/AppLauncherWithDatabase.swift

@@ -32,6 +32,11 @@ public class AppLauncherWithDatabase: NSObject, AppLauncher {
   public var launchAssetUrl: URL?
   public var assetFilesMap: [String: String]?
 
+  /// Set when the launched update is served directly from the embedded app binary. Tracked
+  /// explicitly because `assetFilesMap` is now populated with the bundle-resolved embedded assets,
+  /// so it can no longer double as the "using embedded assets" signal.
+  private var launchedFromEmbeddedBundle = false
+
   private let launcherQueue: DispatchQueue
   private var completedAssets: Int
   private let config: UpdatesConfig
@@ -54,7 +59,7 @@ public class AppLauncherWithDatabase: NSObject, AppLauncher {
   }
 
   public func isUsingEmbeddedAssets() -> Bool {
-    return assetFilesMap == nil
+    return launchedFromEmbeddedBundle
   }
 
   public static func launchableUpdate(
@@ -178,7 +183,10 @@ public class AppLauncherWithDatabase: NSObject, AppLauncher {
     }
 
     if launchedUpdate.status == UpdateStatus.StatusEmbedded {
-      precondition(assetFilesMap == nil, "assetFilesMap should be null for embedded updates")
+      launchedFromEmbeddedBundle = true
+      // The embedded update's assets aren't copied into the cache, so resolve them from the app
+      // binary. Populating the map here keeps `Updates.localAssets` available instead of empty.
+      assetFilesMap = UpdatesUtils.embeddedAssetsMap(withConfig: config, database: database, logger: logger)
       launchAssetUrl = Bundle.main.url(
         forResource: EmbeddedAppLoader.EXUpdatesBareEmbeddedBundleFilename,
         withExtension: EmbeddedAppLoader.EXUpdatesBareEmbeddedBundleFileType

package/ios/EXUpdates/AppLoader/EmbeddedAppLoader.swift

@@ -8,14 +8,12 @@
 import Foundation
 
 /**
- * Subclass of AppLoader which handles copying the embedded update's assets into the
- * expo-updates cache location.
+ * Subclass of AppLoader which loads the embedded update.
  *
- * Rather than launching the embedded update directly from its location in the app bundle/apk, we
- * first try to read it into the expo-updates cache and database and launch it like any other
- * update. The benefits of this include (a) a single code path for launching most updates and (b)
- * assets included in embedded updates and copied into the cache in this way do not need to be
- * redownloaded if included in future updates.
+ * By default (`EX_UPDATES_COPY_EMBEDDED_ASSETS` off) the update is registered but its assets aren't
+ * read into the database; it keeps StatusEmbedded and launches from the app binary, so first launch
+ * stays fast. When the flag is on, assets are read into the database and it launches like any other
+ * update, so a later update reusing them avoids a redownload.
  */
 @objc(EXUpdatesEmbeddedAppLoader)
 @objcMembers
@@ -29,6 +27,24 @@ public final class EmbeddedAppLoader: AppLoader {
 
   private static var embeddedManifestInternal: EmbeddedUpdate?
 
+  /// Whether to read and hash embedded assets into the database on first launch. Defaults to the
+  /// build-time `EX_UPDATES_COPY_EMBEDDED_ASSETS` flag (off). Overridable for testing.
+  internal var shouldCopyEmbeddedAssets: Bool = UpdatesUtils.shouldCopyEmbeddedAssets()
+
+  internal let completionQueue: DispatchQueue
+
+  public required override init(
+    config: UpdatesConfig,
+    logger: UpdatesLogger,
+    database: UpdatesDatabase,
+    directory: URL,
+    launchedUpdate: Update?,
+    completionQueue: DispatchQueue
+  ) {
+    self.completionQueue = completionQueue
+    super.init(config: config, logger: logger, database: database, directory: directory, launchedUpdate: launchedUpdate, completionQueue: completionQueue)
+  }
+
   /**
    Gets the embedded update.
    If the `UpdatesConfig.hasEmbeddedUpdate` is false, it returns nil
@@ -136,6 +152,18 @@ public final class EmbeddedAppLoader: AppLoader {
     self.assetBlock = assetBlock
     self.successBlock = successBlock
     self.errorBlock = errorBlock
+    startEmbeddedLoad(fromEmbeddedManifest: embeddedManifest)
+  }
+
+  /// Loads the embedded update: with copying off (default) registers it without ingesting assets,
+  /// otherwise loads them like any other update. Separate from `loadUpdateResponseFromEmbeddedManifest`
+  /// so tests can pass a manifest without reading the bundle.
+  internal func startEmbeddedLoad(fromEmbeddedManifest embeddedManifest: Update) {
+    if !shouldCopyEmbeddedAssets {
+      registerEmbeddedUpdateWithoutCopying(embeddedManifest)
+      return
+    }
+
     startLoading(fromUpdateResponse: UpdateResponse(
       responseHeaderData: nil,
       manifestUpdateResponsePart: ManifestUpdateResponsePart(updateManifest: embeddedManifest),
@@ -143,6 +171,40 @@ public final class EmbeddedAppLoader: AppLoader {
     ))
   }
 
+  /// Registers the embedded update without reading, hashing, or copying its assets. A StatusEmbedded
+  /// update resolves its bundle and assets from the app binary at launch. Tradeoff: a future update
+  /// reusing an embedded asset re-downloads it.
+  private func registerEmbeddedUpdateWithoutCopying(_ embeddedManifest: Update) {
+    database.databaseQueue.async {
+      do {
+        let existingUpdate = try? self.database.update(withId: embeddedManifest.updateId, config: self.config)
+        if existingUpdate == nil {
+          try self.database.addUpdate(embeddedManifest, config: self.config)
+        }
+        // Mark finished (keep = 1) so the reaper retains it; it stays StatusEmbedded since copying is off.
+        try self.database.markUpdateFinished(embeddedManifest)
+      } catch {
+        let errorBlock = self.errorBlock
+        self.completionQueue.async {
+          errorBlock?(UpdatesError.appLoaderUnknownError(cause: error))
+          self.reset()
+        }
+        return
+      }
+
+      let successBlock = self.successBlock
+      let updateResponse = UpdateResponse(
+        responseHeaderData: nil,
+        manifestUpdateResponsePart: ManifestUpdateResponsePart(updateManifest: embeddedManifest),
+        directiveUpdateResponsePart: nil
+      )
+      self.completionQueue.async {
+        successBlock?(updateResponse)
+        self.reset()
+      }
+    }
+  }
+
   override public func downloadAsset(_ asset: UpdateAsset, extraHeaders: [String: Any]) {
     FileDownloader.assetFilesQueue.async {
       self.handleAssetDownloadAlreadyExists(asset)

package/ios/EXUpdates/AppLoader/RemoteAppLoader.swift

@@ -99,6 +99,13 @@ public final class RemoteAppLoader: AppLoader {
   }
 
   override public func downloadAsset(_ asset: UpdateAsset, extraHeaders: [String: Any]) {
+    guard UpdatesUtils.isSafeFilename(asset.filename) else {
+      self.handleAssetDownload(
+        withError: UpdatesError.remoteAppLoaderUnsafeAssetFilename(filename: asset.filename),
+        asset: asset
+      )
+      return
+    }
     let urlOnDisk = self.directory.appendingPathComponent(asset.filename)
 
     let progressBlock = { [weak self] fractionCompleted in

package/ios/EXUpdates/Database/UpdatesDatabase.swift

@@ -280,7 +280,11 @@ public final class UpdatesDatabase: NSObject {
   }
 
   public func markUpdateFinished(_ update: Update) throws {
-    if update.status != UpdateStatus.StatusDevelopment {
+    // With copying off, embedded updates have no asset rows, so they must stay StatusEmbedded to keep
+    // launching from the bundle. Promoting to StatusReady would route launch through the database
+    // asset path, which has no rows for them.
+    let keepEmbedded = update.status == UpdateStatus.StatusEmbedded && !UpdatesUtils.shouldCopyEmbeddedAssets()
+    if update.status != UpdateStatus.StatusDevelopment && !keepEmbedded {
       update.status = UpdateStatus.StatusReady
     }
 

package/ios/EXUpdates/Database/UpdatesReaper.swift

@@ -71,6 +71,10 @@ public final class UpdatesReaper: NSObject {
 
         let beginDeleteAssets = Date()
         for asset in assetsForDeletion {
+          guard UpdatesUtils.isSafeFilename(asset.filename) else {
+            logger.warn(message: "Refusing to delete asset at unsafe path \(asset.filename)")
+            continue
+          }
           let localUrl = directory.appendingPathComponent(asset.filename)
           if FileManager.default.fileExists(atPath: localUrl.path) {
             do {

package/ios/EXUpdates/Update/Update.swift

@@ -77,6 +77,7 @@ public enum UpdateStatus: Int {
 public enum UpdateError: Error, Sendable, LocalizedError {
   case invalidExpoProtocolVersion(protocolVersion: Int)
   case legacyManifestInstantiationInvalid
+  case unsafeAssetFilename(updateId: String, filename: String)
 
   public var errorDescription: String? {
     switch self {
@@ -84,6 +85,10 @@ public enum UpdateError: Error, Sendable, LocalizedError {
       return "Invalid Expo Updates protocol version: \(protocolVersion)"
     case .legacyManifestInstantiationInvalid:
       return "This version of expo-updates can no longer load legacy manifests"
+    case let .unsafeAssetFilename(updateId, filename):
+      return "Update \(updateId) could not be loaded because the asset filename \"\(filename)\" " +
+        "is not a valid filename. Assets are stored under their key and file extension, so neither " +
+        "may contain a path separator. Check the server that produced this manifest."
     }
   }
 }
@@ -157,12 +162,21 @@ public class Update: NSObject {
     }
     switch protocolVersion {
     case 0, 1:
-      return ExpoUpdatesUpdate.update(
+      let update = ExpoUpdatesUpdate.update(
         withExpoUpdatesManifest: ExpoUpdatesManifest(rawManifestJSON: withManifest),
         extensions: extensions,
         config: config,
         database: database
       )
+      try update.assets()?.forEach { asset in
+        guard UpdatesUtils.isSafeFilename(asset.filename) else {
+          throw UpdateError.unsafeAssetFilename(
+            updateId: update.updateId.uuidString,
+            filename: asset.filename
+          )
+        }
+      }
+      return update
     default:
       throw UpdateError.invalidExpoProtocolVersion(protocolVersion: protocolVersion)
     }

package/ios/EXUpdates/UpdatesError.swift

@@ -26,6 +26,7 @@ public enum UpdatesError: Error, Sendable, LocalizedError {
   case fileDownloaderFailedUpdateIDsFailure(cause: Error)
   case fileDownloaderUnknownError(cause: Error)
   case remoteAppLoaderAssetMissingUrl
+  case remoteAppLoaderUnsafeAssetFilename(filename: String)
   case remoteAppLoaderHeaderDataError(cause: Error)
   case remoteAppLoaderUnknownError(cause: Error)
   case appLoaderFailedToLoadAllAssets
@@ -92,6 +93,8 @@ public enum UpdatesError: Error, Sendable, LocalizedError {
       return "Unknown error: \(cause.localizedDescription)"
     case .remoteAppLoaderAssetMissingUrl:
       return "Failed to download asset with no URL provided"
+    case let .remoteAppLoaderUnsafeAssetFilename(filename):
+      return "Failed to download asset: filename \"\(filename)\" would resolve outside the updates directory"
     case let .remoteAppLoaderHeaderDataError(cause):
       return "Error persisting header data to disk: \(cause.localizedDescription)"
     case .appLoaderFailedToLoadAllAssets:

package/ios/EXUpdates/UpdatesUtils.swift

@@ -59,6 +59,23 @@ public final class UpdatesUtils: NSObject {
     return updatesDirectory
   }
 
+  /**
+   * Asset filenames are built from manifest-controlled values, so a filename holding a path
+   * separator or a `..` component would resolve outside the updates directory.
+   *
+   * Matching is done on unicode scalars because `String.contains` compares grapheme clusters, and
+   * a separator followed by a combining mark forms one cluster that does not equal the separator.
+   * The filesystem still sees the separator byte.
+   */
+  public static func isSafeFilename(_ filename: String) -> Bool {
+    return !filename.isEmpty &&
+      filename != "." &&
+      filename != ".." &&
+      !filename.unicodeScalars.contains("/") &&
+      !filename.unicodeScalars.contains("\\") &&
+      !filename.unicodeScalars.contains("\0")
+  }
+
   // MARK: - Internal methods
 
   public static func defaultNativeStateMachineContextJson() -> [String: Any?] {
@@ -149,6 +166,14 @@ public final class UpdatesUtils: NSObject {
 #endif
   }
 
+  internal static func shouldCopyEmbeddedAssets() -> Bool {
+#if EX_UPDATES_COPY_EMBEDDED_ASSETS
+    return true
+#else
+    return false
+#endif
+  }
+
   internal static func runBlockOnMainThread(_ block: @escaping () -> Void) {
     if Thread.isMainThread {
       block()

package/ios/EXUpdates.podspec

@@ -9,6 +9,9 @@ end
 if ENV['EX_UPDATES_CUSTOM_INIT'] != '1'
   ENV['EX_UPDATES_CUSTOM_INIT'] = podfile_properties['updatesCustomInit'] == 'true' ? '1' : '0'
 end
+if ENV['EX_UPDATES_COPY_EMBEDDED_ASSETS'] != '1'
+  ENV['EX_UPDATES_COPY_EMBEDDED_ASSETS'] = podfile_properties['updatesCopyEmbeddedAssets'] == 'true' ? '1' : '0'
+end
 
 use_dev_client = false
 begin
@@ -61,6 +64,7 @@ Pod::Spec.new do |s|
 
   ex_updates_native_debug = ENV['EX_UPDATES_NATIVE_DEBUG'] == '1'
   ex_updates_custom_init = ENV['EX_UPDATES_CUSTOM_INIT'] == '1'
+  ex_updates_copy_embedded_assets = ENV['EX_UPDATES_COPY_EMBEDDED_ASSETS'] == '1'
   if ex_updates_native_debug
     other_debug_c_flags << ' -DEX_UPDATES_NATIVE_DEBUG=1'
     other_debug_swift_flags << ' -DEX_UPDATES_NATIVE_DEBUG'
@@ -71,6 +75,12 @@ Pod::Spec.new do |s|
     other_release_c_flags << ' -DEX_UPDATES_CUSTOM_INIT=1'
     other_release_swift_flags << ' -DEX_UPDATES_CUSTOM_INIT'
   end
+  if ex_updates_copy_embedded_assets
+    other_debug_c_flags << ' -DEX_UPDATES_COPY_EMBEDDED_ASSETS=1'
+    other_debug_swift_flags << ' -DEX_UPDATES_COPY_EMBEDDED_ASSETS'
+    other_release_c_flags << ' -DEX_UPDATES_COPY_EMBEDDED_ASSETS=1'
+    other_release_swift_flags << ' -DEX_UPDATES_COPY_EMBEDDED_ASSETS'
+  end
   if use_dev_client
     other_debug_c_flags << ' -DUSE_DEV_CLIENT=1'
     other_debug_swift_flags << ' -DUSE_DEV_CLIENT'
@@ -99,11 +109,17 @@ Pod::Spec.new do |s|
 
   if $expo_updates_create_updates_resources != false
     force_bundling_flag = ex_updates_native_debug ? "export FORCE_BUNDLING=1\n" : ""
-    s.script_phase = {
+    script_phase = {
       :name => 'Generate updates resources for expo-updates',
       :script => force_bundling_flag + 'bash -l -c "$PODS_TARGET_SRCROOT/../scripts/create-updates-resources-ios.sh"',
       :execution_position => :before_compile
     }
+    # :always_out_of_date is only available in CocoaPods 1.13.0 and later
+    if Gem::Version.new(Pod::VERSION) >= Gem::Version.new('1.13.0')
+      # always run the script without warning
+      script_phase[:always_out_of_date] = "1"
+    end
+    s.script_phase = script_phase
 
     # Generate EXUpdates.bundle without existing resources
     # `create-updates-resources-ios.sh` will generate updates resources in EXUpdates.bundle
@@ -121,6 +137,7 @@ Pod::Spec.new do |s|
     test_spec.dependency 'ExpoModulesTestCore'
 
     test_spec.pod_target_xcconfig = {
+      'OTHER_LDFLAGS' => '$(inherited) -lc++',
       'USER_HEADER_SEARCH_PATHS' => '"${CONFIGURATION_TEMP_DIR}/EXUpdates.build/DerivedSources"',
       'GCC_TREAT_INCOMPATIBLE_POINTER_TYPE_WARNINGS_AS_ERRORS' => 'YES',
       'GCC_TREAT_IMPLICIT_FUNCTION_DECLARATIONS_AS_ERRORS' => 'YES',

package/ios/Tests/EmbeddedAppLoaderTests.swift

@@ -0,0 +1,94 @@
+//  Copyright (c) 2024 650 Industries, Inc. All rights reserved.
+
+import Testing
+
+@testable import EXUpdates
+
+import EXManifests
+
+@Suite("EmbeddedAppLoader", .serialized)
+@MainActor
+class EmbeddedAppLoaderTests {
+  var testDatabaseDir: URL
+  var db: UpdatesDatabase
+
+  init() throws {
+    let applicationSupportDir = FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask).last
+    testDatabaseDir = applicationSupportDir!.appendingPathComponent("EmbeddedAppLoaderTests")
+
+    try? FileManager.default.removeItem(atPath: testDatabaseDir.path)
+
+    if !FileManager.default.fileExists(atPath: testDatabaseDir.path) {
+      try FileManager.default.createDirectory(atPath: testDatabaseDir.path, withIntermediateDirectories: true)
+    }
+
+    db = UpdatesDatabase()
+    db.databaseQueue.sync {
+      try! db.openDatabase(inDirectory: testDatabaseDir, logger: UpdatesLogger())
+    }
+  }
+
+  deinit {
+    db.databaseQueue.sync {
+      db.closeDatabase()
+    }
+    try? FileManager.default.removeItem(atPath: testDatabaseDir.path)
+  }
+
+  @Test
+  func `no-copy registers the embedded update without ingesting non-launch assets`() async throws {
+    let config = try UpdatesConfig.config(fromDictionary: [
+      UpdatesConfig.EXUpdatesConfigUpdateUrlKey: "https://example.com",
+      UpdatesConfig.EXUpdatesConfigScopeKeyKey: "dummyScope",
+      UpdatesConfig.EXUpdatesConfigRuntimeVersionKey: "1",
+    ])
+
+    // Build an embedded update with a couple of non-launch assets without touching the app bundle,
+    // mirroring UpdateTests' `works for embedded bare manifest`.
+    let embeddedManifestJSON: [String: Any] = [
+      "id": "0eef8214-4833-4089-9dff-b4138a14f196",
+      "commitTime": 1609975977832,
+      "assets": [
+        ["packagerHash": "embedded-asset-1", "type": "png", "nsBundleFilename": "image1"],
+        ["packagerHash": "embedded-asset-2", "type": "png", "nsBundleFilename": "image2"],
+      ],
+    ]
+    let embeddedUpdate = Update.update(
+      withRawEmbeddedManifest: embeddedManifestJSON,
+      config: config,
+      database: db
+    )
+
+    let loader = EmbeddedAppLoader(
+      config: config,
+      logger: UpdatesLogger(),
+      database: db,
+      directory: testDatabaseDir,
+      launchedUpdate: nil,
+      completionQueue: DispatchQueue.global(qos: .default)
+    )
+    loader.shouldCopyEmbeddedAssets = false
+
+    let success: Bool = await withCheckedContinuation { continuation in
+      loader.updateResponseBlock = { _ in true }
+      loader.assetBlock = { _, _, _, _ in }
+      loader.successBlock = { _ in continuation.resume(returning: true) }
+      loader.errorBlock = { _ in continuation.resume(returning: false) }
+      loader.startEmbeddedLoad(fromEmbeddedManifest: embeddedUpdate)
+    }
+
+    #expect(success == true)
+
+    db.databaseQueue.sync {
+      // The update row is registered and stays StatusEmbedded (not promoted to StatusReady), so later
+      // launches keep resolving it from the app bundle rather than the empty database asset path.
+      let storedUpdate = try! db.update(withId: embeddedUpdate.updateId, config: config)
+      #expect(storedUpdate != nil)
+      #expect(storedUpdate?.status == .StatusEmbedded)
+
+      // Its non-launch assets were not read, hashed, or inserted.
+      let asset = try? db.asset(withKey: "embedded-asset-1")
+      #expect(asset == nil)
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-updates",
-  "version": "29.0.18",
+  "version": "29.0.20",
   "description": "Fetches and manages remotely-hosted assets and updates to your app's JS bundle.",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -73,5 +73,5 @@
     "react": "*",
     "react-native": "*"
   },
-  "gitHead": "45c60e10956764bbac6c62454890eeb25c74bbd6"
+  "gitHead": "5b42e3d21e0ac5e086752361ca8a5cb4de53bec1"
 }

package/utils/build/findUpProjectRoot.js

@@ -7,13 +7,14 @@ exports.findUpProjectRoot = findUpProjectRoot;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 function findUpProjectRoot(cwd) {
-    if (['.', path_1.default.sep].includes(cwd)) {
+    if (cwd === path_1.default.sep || cwd === '.') {
         return null;
     }
-    if (fs_1.default.existsSync(path_1.default.join(cwd, 'package.json'))) {
-        return cwd;
-    }
-    else {
-        return findUpProjectRoot(path_1.default.dirname(cwd));
+    for (let dir = cwd; path_1.default.dirname(dir) !== dir; dir = path_1.default.dirname(dir)) {
+        const file = path_1.default.resolve(dir, 'package.json');
+        if (fs_1.default.existsSync(file)) {
+            return dir;
+        }
     }
+    return null;
 }

package/utils/src/findUpProjectRoot.ts

@@ -2,13 +2,15 @@ import fs from 'fs';
 import path from 'path';
 
 export function findUpProjectRoot(cwd: string): string | null {
-  if (['.', path.sep].includes(cwd)) {
+  if (cwd === path.sep || cwd === '.') {
     return null;
   }
 
-  if (fs.existsSync(path.join(cwd, 'package.json'))) {
-    return cwd;
-  } else {
-    return findUpProjectRoot(path.dirname(cwd));
+  for (let dir = cwd; path.dirname(dir) !== dir; dir = path.dirname(dir)) {
+    const file = path.resolve(dir, 'package.json');
+    if (fs.existsSync(file)) {
+      return dir;
+    }
   }
+  return null;
 }