expo-updates 55.0.29 → 55.0.31

package/CHANGELOG.md

@@ -10,6 +10,22 @@
 
 ### 💡 Others
 
+## 55.0.31 — 2026-09-17
+
+### 🐛 Bug fixes
+
+- [iOS] Apply bundle diffs against the embedded bundle in the app binary when the launched update is the embedded one, instead of failing to resolve a patch base and downloading the full bundle. ([#50018](https://github.com/expo/expo/pull/50018) by [@alanjhughes](https://github.com/alanjhughes))
+- [Android] Apply bundle diffs against the embedded bundle in the app binary when the launched update is the embedded one, instead of failing to resolve a patch base and downloading the full bundle. ([#50019](https://github.com/expo/expo/pull/50019) by [@alanjhughes](https://github.com/alanjhughes))
+
+## 55.0.30 — 2026-08-28
+
+### 🐛 Bug fixes
+
+- [iOS] Propagate database failures from `addNewAssets` instead of swallowing them, which let an update be marked ready without its launch asset and then fail every launch. ([#49456](https://github.com/expo/expo/pull/49456) by [@alanjhughes](https://github.com/alanjhughes))
+- [iOS] Repair ready updates that are missing their launch asset by demoting them to pending during launcher selection, so a corrupted row is skipped and retried instead of failing every launch. ([#49457](https://github.com/expo/expo/pull/49457) by [@alanjhughes](https://github.com/alanjhughes))
+- [Android] Skip and repair updates that are missing their launch asset instead of selecting them for launch, which previously failed every cold start with "Launch asset not found for update". ([#49470](https://github.com/expo/expo/pull/49470) by [@alanjhughes](https://github.com/alanjhughes), based on [#48733](https://github.com/expo/expo/pull/48733) by [@martintreurnicht](https://github.com/martintreurnicht))
+- [iOS] Fix the embedded manifest recording the wrong `packagerHash` for assets that ship scale variants iOS does not allow (such as `@1.5x` and `@4x`): the hashes were read by the filtered scale index instead of the asset's own, so those images resolved to an empty URI and rendered blank in release builds. ([#48811](https://github.com/expo/expo/pull/48811) by [@expo-bot](https://github.com/expo-bot))
+
 ## 55.0.29 — 2026-08-27
 
 ### 🐛 Bug fixes

package/android/build.gradle

@@ -42,7 +42,7 @@ expoModule {
 }
 
 group = 'host.exp.exponent'
-version = '55.0.29'
+version = '55.0.31'
 
 // Utility method to derive boolean values from the environment or from Java properties,
 // and return them as strings to be used in BuildConfig fields
@@ -89,7 +89,7 @@ android {
   namespace "expo.modules.updates"
   defaultConfig {
     versionCode 31
-    versionName '55.0.29'
+    versionName '55.0.31'
     consumerProguardFiles("proguard-rules.pro")
     testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
 

package/android/src/main/java/expo/modules/updates/launcher/DatabaseLauncher.kt

@@ -161,6 +161,15 @@ class DatabaseLauncher(
       if (!configuration.hasEmbeddedUpdate && embeddedUpdate?.updateEntity?.id == update.id) {
         continue
       }
+
+      // An update with no launch asset can never launch. Excluding it here lets the loader
+      // re-run and repair the row instead of failing every cold start.
+      if (update.status != UpdateStatus.DEVELOPMENT &&
+        database.updateDao().loadLaunchAssetForUpdate(update.id) == null
+      ) {
+        logger.warn("Skipping launchable update with no launch asset. Debug info: ${update.debugInfo()}")
+        continue
+      }
       filteredLaunchableUpdates.add(update)
     }
     val manifestFilters = ManifestMetadata.getManifestFilters(database, configuration)

package/android/src/main/java/expo/modules/updates/loader/FileDownloader.kt

@@ -22,6 +22,7 @@ import expo.modules.updates.manifest.ResponsePartHeaderData
 import expo.modules.updates.manifest.ResponsePartInfo
 import expo.modules.updates.manifest.UpdateFactory
 import expo.modules.updates.selectionpolicy.SelectionPolicies
+import expo.modules.updates.utils.AndroidResourceAssetUtils
 import kotlinx.coroutines.suspendCancellableCoroutine
 import okhttp3.Cache
 import okhttp3.Headers
@@ -51,6 +52,7 @@ import kotlin.math.min
 
 private const val PATCH_TEMP_SUFFIX = ".patch"
 private const val PATCHED_TEMP_SUFFIX = ".patched"
+private const val PATCH_BASE_TEMP_SUFFIX = ".base"
 private const val A_IM_HEADER = "A-IM"
 private const val IM_HEADER = "im"
 private const val EXPO_BASE_UPDATE_ID_RESPONSE_HEADER = "expo-base-update-id"
@@ -58,6 +60,8 @@ private const val EXPO_CURRENT_UPDATE_ID_HEADER = "Expo-Current-Update-ID"
 private const val EXPO_REQUESTED_UPDATE_ID_HEADER = "Expo-Requested-Update-ID"
 private const val EXPO_EMBEDDED_UPDATE_ID_HEADER = "Expo-Embedded-Update-ID"
 
+internal typealias EmbeddedAssetExtractor = (AssetEntity, File) -> Unit
+
 /**
  * Utility class that holds all the logic for downloading data and files, such as update manifests
  * and assets, using an instance of [OkHttpClient].
@@ -107,7 +111,8 @@ class FileDownloader(
     progressListener: FileDownloadProgressListener? = null,
     allowPatch: Boolean,
     launchedUpdate: UpdateEntity? = null,
-    requestedUpdate: UpdateEntity? = null
+    requestedUpdate: UpdateEntity? = null,
+    embeddedAssetExtractor: EmbeddedAssetExtractor? = null
   ): FileDownloadResult {
     try {
       val response = downloadData(request, progressListener)
@@ -176,7 +181,8 @@ class FileDownloader(
                 updatesDirectory = updatesDirectory,
                 launchedUpdate = launchedUpdate,
                 requestedUpdate = requestedUpdate,
-                expectedBase64URLEncodedSHA256Hash = expectedBase64URLEncodedSHA256Hash
+                expectedBase64URLEncodedSHA256Hash = expectedBase64URLEncodedSHA256Hash,
+                embeddedAssetExtractor = embeddedAssetExtractor
               )
             }.getOrElse {
               logger.warn(
@@ -294,36 +300,47 @@ class FileDownloader(
     updatesDirectory: File,
     launchedUpdate: UpdateEntity,
     requestedUpdate: UpdateEntity?,
-    expectedBase64URLEncodedSHA256Hash: String?
+    expectedBase64URLEncodedSHA256Hash: String?,
+    embeddedAssetExtractor: EmbeddedAssetExtractor? = null
   ): ByteArray {
     val launchAssetContext = prepareAssetForDiff(
       asset = asset,
       responseBody = responseBody,
+      destination = destination,
       updatesDirectory = updatesDirectory,
-      launchedUpdate = launchedUpdate
+      launchedUpdate = launchedUpdate,
+      embeddedAssetExtractor = embeddedAssetExtractor
     )
 
-    return applyHermesDiff(
-      baseFile = launchAssetContext.baseFile,
-      diffBody = responseBody,
-      destination = destination,
-      expectedBase64URLEncodedSHA256Hash = expectedBase64URLEncodedSHA256Hash,
-      asset = asset,
-      requestedUpdateId = requestedUpdate?.id?.toString()
-    )
+    try {
+      return applyHermesDiff(
+        baseFile = launchAssetContext.baseFile,
+        diffBody = responseBody,
+        destination = destination,
+        expectedBase64URLEncodedSHA256Hash = expectedBase64URLEncodedSHA256Hash,
+        asset = asset,
+        requestedUpdateId = requestedUpdate?.id?.toString()
+      )
+    } finally {
+      if (launchAssetContext.isTemporary) {
+        launchAssetContext.baseFile.delete()
+      }
+    }
   }
 
-  internal data class LaunchAssetContext(val baseFile: File)
+  internal data class LaunchAssetContext(val baseFile: File, val isTemporary: Boolean = false)
 
   @VisibleForTesting
   internal fun prepareAssetForDiff(
     asset: AssetEntity,
     responseBody: ResponseBody,
+    destination: File,
     updatesDirectory: File,
-    launchedUpdate: UpdateEntity
+    launchedUpdate: UpdateEntity,
+    embeddedAssetExtractor: EmbeddedAssetExtractor? = null
   ): LaunchAssetContext {
     return try {
-      preparePatchBaseAsset(asset, updatesDirectory, launchedUpdate)
+      preparePatchBaseAsset(asset, destination, updatesDirectory, launchedUpdate, embeddedAssetExtractor)
     } catch (e: Exception) {
       responseBody.close()
       if (e is IOException) {
@@ -336,8 +353,10 @@ class FileDownloader(
 
   private fun preparePatchBaseAsset(
     asset: AssetEntity,
+    destination: File,
     updatesDirectory: File,
-    launchedUpdate: UpdateEntity
+    launchedUpdate: UpdateEntity,
+    embeddedAssetExtractor: EmbeddedAssetExtractor? = null
   ): LaunchAssetContext {
     if (!asset.isLaunchAsset) {
       throw IOException("Received patch for non-launch asset ${asset.key}")
@@ -351,29 +370,60 @@ class FileDownloader(
     val launchAssetRelativePath = launchAssetEntity.relativePath
       ?: throw IOException("Launch asset for update $currentUpdateId is missing a relative path")
 
-    val baseFile = File(updatesDirectory, launchAssetRelativePath)
+    // BSPatch needs a real path, so an asset inside the APK is extracted first.
+    val isEmbeddedLaunchAsset = AndroidResourceAssetUtils.isAndroidResourceAsset(launchAssetRelativePath)
+    val baseFile = if (isEmbeddedLaunchAsset) {
+      extractEmbeddedPatchBaseAsset(launchAssetEntity, destination, embeddedAssetExtractor)
+    } else {
+      File(updatesDirectory, launchAssetRelativePath)
+    }
     if (!baseFile.exists()) {
       throw IOException("Base asset $baseFile is missing; cannot apply patch")
     }
 
-    val actualBaseHash = try {
-      UpdatesUtils.toBase64Url(UpdatesUtils.sha256(baseFile))
-    } catch (_: Exception) {
-      null
+    val expectedBaseHash = launchAssetEntity.expectedHash
+    if (expectedBaseHash != null) {
+      val actualBaseHash = try {
+        UpdatesUtils.toBase64Url(UpdatesUtils.sha256(baseFile))
+      } catch (_: Exception) {
+        null
+      }
+      if (actualBaseHash != null && expectedBaseHash != actualBaseHash) {
+        logger.warn(
+          "Asset hash mismatch for update $currentUpdateId; expected=$expectedBaseHash actual=$actualBaseHash",
+          UpdatesErrorCode.AssetsFailedToLoad,
+          currentUpdateId.toString(),
+          asset.key
+        )
+        if (isEmbeddedLaunchAsset) {
+          baseFile.delete()
+        }
+        throw IOException("Asset hash mismatch for update $currentUpdateId; expected=$expectedBaseHash actual=$actualBaseHash")
+      }
     }
 
-    val expectedBaseHash = launchAssetEntity.expectedHash
-    if (expectedBaseHash != null && actualBaseHash != null && expectedBaseHash != actualBaseHash) {
-      logger.warn(
-        "Asset hash mismatch for update $currentUpdateId; expected=$expectedBaseHash actual=$actualBaseHash",
-        UpdatesErrorCode.AssetsFailedToLoad,
-        currentUpdateId.toString(),
-        asset.key
-      )
-      throw IOException("Asset hash mismatch for update $currentUpdateId; expected=$expectedBaseHash actual=$actualBaseHash")
+    return LaunchAssetContext(baseFile, isTemporary = isEmbeddedLaunchAsset)
+  }
+
+  @Throws(IOException::class)
+  private fun extractEmbeddedPatchBaseAsset(
+    launchAssetEntity: AssetEntity,
+    destination: File,
+    embeddedAssetExtractor: EmbeddedAssetExtractor?
+  ): File {
+    if (embeddedAssetExtractor == null) {
+      throw IOException("The launch asset lives in the app binary and cannot be extracted without an extractor")
     }
 
-    return LaunchAssetContext(baseFile)
+    val baseFile = File(destination.absolutePath + PATCH_BASE_TEMP_SUFFIX)
+    try {
+      baseFile.parentFile?.mkdirs()
+      embeddedAssetExtractor(launchAssetEntity, baseFile)
+    } catch (e: Exception) {
+      baseFile.delete()
+      throw e as? IOException ?: IOException("Failed to extract the embedded launch asset", e)
+    }
+    return baseFile
   }
 
   @VisibleForTesting
@@ -678,7 +728,8 @@ class FileDownloader(
     extraHeaders: JSONObject,
     launchedUpdate: UpdateEntity?,
     requestedUpdate: UpdateEntity?,
-    assetLoadProgressListener: ((Double) -> Unit)? = null
+    assetLoadProgressListener: ((Double) -> Unit)? = null,
+    embeddedAssetExtractor: EmbeddedAssetExtractor? = null
   ): AssetDownloadResult {
     if (asset.url == null) {
       val message = "Failed to download asset ${asset.key}"
@@ -722,7 +773,8 @@ class FileDownloader(
           assetLoadProgressListener?.let { listener -> { listener.invoke(it) } },
           allowPatch = canApplyPatch,
           launchedUpdate = launchedUpdate,
-          requestedUpdate = requestedUpdate
+          requestedUpdate = requestedUpdate,
+          embeddedAssetExtractor = embeddedAssetExtractor
         )
 
         asset.downloadTime = Date()

package/android/src/main/java/expo/modules/updates/loader/Loader.kt

@@ -166,7 +166,11 @@ abstract class Loader protected constructor(
       database.updateDao().setUpdateScopeKey(existingUpdateEntity, newUpdateEntity.scopeKey)
     }
 
-    if (existingUpdateEntity != null && existingUpdateEntity.status == UpdateStatus.READY) {
+    // A READY update with no launch asset is not actually ready. Fall through to
+    // downloadAllAssets so its assets are re-registered instead of staying broken forever.
+    if (existingUpdateEntity != null && existingUpdateEntity.status == UpdateStatus.READY &&
+      database.updateDao().loadLaunchAssetForUpdate(existingUpdateEntity.id) != null
+    ) {
       // hooray, we already have this update downloaded and ready to go!
       updateEntity = existingUpdateEntity
       return finish()

package/android/src/main/java/expo/modules/updates/loader/RemoteLoader.kt

@@ -14,6 +14,7 @@ import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
 import java.io.File
+import java.io.IOException
 
 data class ProcessSuccessLoaderResult(
   val availableUpdate: UpdateEntity?,
@@ -66,9 +67,28 @@ class RemoteLoader internal constructor(
     embeddedUpdate: UpdateEntity?
   ): FileDownloader.AssetDownloadResult {
     val extraHeaders = FileDownloader.getExtraHeadersForRemoteAssetRequest(launchedUpdate, embeddedUpdate, requestedUpdate)
-    return mFileDownloader.downloadAsset(assetEntity, updatesDirectory, extraHeaders, launchedUpdate, requestedUpdate) { progress ->
-      assetLoadProgressListener(assetEntity, progress)
-    }
+    return mFileDownloader.downloadAsset(
+      asset = assetEntity,
+      destinationDirectory = updatesDirectory,
+      extraHeaders = extraHeaders,
+      launchedUpdate = launchedUpdate,
+      requestedUpdate = requestedUpdate,
+      embeddedAssetExtractor = { launchAsset, destination ->
+        // The stored path is not the APK asset name; resolve it through the embedded manifest by key.
+        val embeddedLaunchAsset = loaderFiles.readEmbeddedUpdate(context, configuration)
+          ?.assetEntityList
+          ?.find { it.key == launchAsset.key }
+          ?: throw IOException("No embedded asset matches launch asset ${launchAsset.key}")
+        val assetName = embeddedLaunchAsset.embeddedAssetFilename
+          ?: throw IOException("Embedded launch asset ${launchAsset.key} has no APK asset filename")
+        context.assets.open(assetName).use { input ->
+          destination.outputStream().use { output -> input.copyTo(output) }
+        }
+      },
+      assetLoadProgressListener = { progress ->
+        assetLoadProgressListener(assetEntity, progress)
+      }
+    )
   }
 
   companion object {

package/ios/EXUpdates/AppLoader/FileDownloader.swift

@@ -84,6 +84,12 @@ public final class FileDownloader {
   private let updatesDirectory: URL
   private let database: UpdatesDatabase
 
+  /// Overridable for testing, where the fixture is not in `updatesBundle`.
+  internal var embeddedLaunchAssetUrl: URL? = updatesBundle.url(
+    forResource: EmbeddedAppLoader.EXUpdatesBareEmbeddedBundleFilename,
+    withExtension: EmbeddedAppLoader.EXUpdatesBareEmbeddedBundleFileType
+  )
+
   public convenience init(
     config: UpdatesConfig,
     logger: UpdatesLogger,
@@ -557,8 +563,7 @@ public final class FileDownloader {
       throw DiffError.assetNotLaunch
     }
 
-    let baseAsset = try resolveLaunchAsset(launchedUpdate: launchedUpdate)
-    let baseFileUrl = try loadAndVerifyAsset(baseAsset)
+    let baseFileUrl = try resolveBaseFileUrl(launchedUpdate: launchedUpdate)
     let requestedUpdateId = requestedUpdate?.updateId.uuidString
 
     return try createPatchedAsset(
@@ -571,6 +576,19 @@ public final class FileDownloader {
     )
   }
 
+  private func resolveBaseFileUrl(launchedUpdate: Update) throws -> URL {
+    if launchedUpdate.status == UpdateStatus.StatusEmbedded {
+      // StatusEmbedded only launches for this binary's embedded update.
+      guard let embeddedLaunchAssetUrl else {
+        throw DiffError.embeddedBaseAssetMissing
+      }
+      return embeddedLaunchAssetUrl
+    }
+
+    let baseAsset = try resolveLaunchAsset(launchedUpdate: launchedUpdate)
+    return try loadAndVerifyAsset(baseAsset)
+  }
+
   private func resolveLaunchAsset(launchedUpdate: Update) throws -> UpdateAsset {
     let currentUpdateId = launchedUpdate.updateId
     var launchAsset: UpdateAsset?
@@ -1238,6 +1256,7 @@ extension FileDownloader {
     case missingHeader(String)
     case invalidHeader(String)
     case launchAssetNotFound
+    case embeddedBaseAssetMissing
     case baseAssetMissing(path: String)
     case failedToReadBaseAsset(cause: Error)
     case failedToWritePatch(cause: Error, path: String)
@@ -1265,6 +1284,8 @@ extension FileDownloader.DiffError: CustomStringConvertible {
       return "Invalid \(header) header"
     case .launchAssetNotFound:
       return "Launch asset not found for current update"
+    case .embeddedBaseAssetMissing:
+      return "Embedded bundle not found in the app binary"
     case let .baseAssetMissing(path):
       return "Base asset is missing at path \(path)"
     case let .failedToReadBaseAsset(cause):

package/ios/EXUpdates/Database/UpdatesDatabase.swift

@@ -160,7 +160,7 @@ public final class UpdatesDatabase: NSObject {
         )
       } catch {
         sqlite3_exec(db, "ROLLBACK;", nil, nil, nil)
-        return
+        throw error
       }
 
       // statements must stay in precisely this order for last_insert_rowid() to work correctly
@@ -170,7 +170,7 @@ public final class UpdatesDatabase: NSObject {
           _ = try execute(sql: updateSql, withArgs: [updateId])
         } catch {
           sqlite3_exec(db, "ROLLBACK;", nil, nil, nil)
-          return
+          throw error
         }
       }
 
@@ -181,7 +181,7 @@ public final class UpdatesDatabase: NSObject {
         _ = try execute(sql: updateInsertSql, withArgs: [updateId])
       } catch {
         sqlite3_exec(db, "ROLLBACK;", nil, nil, nil)
-        return
+        throw error
       }
     }
 
@@ -444,7 +444,23 @@ public final class UpdatesDatabase: NSObject {
     )
 
     let rows = try execute(sql: sql, withArgs: [config.scopeKey])
-    return rows.map { row in
+
+    // A ready row with no launch asset is corrupt (e.g. from an interrupted registration) and
+    // would fail every launch. Demote it for the loader to retry instead of offering it.
+    var launchableRows: [[String: Any?]] = []
+    for row in rows {
+      let status: NSNumber = row.requiredValue(forKey: "status")
+      let launchAssetId: NSNumber? = row.optionalValue(forKey: "launch_asset_id")
+      if status.intValue == UpdateStatus.StatusReady.rawValue && launchAssetId == nil {
+        let updateId: UUID = row.requiredValue(forKey: "id")
+        let demoteSql = "UPDATE updates SET status = ?1 WHERE id = ?2;"
+        _ = try execute(sql: demoteSql, withArgs: [UpdateStatus.StatusPending.rawValue, updateId])
+      } else {
+        launchableRows.append(row)
+      }
+    }
+
+    return launchableRows.map { row in
       update(withRow: row, config: config)
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-updates",
-  "version": "55.0.29",
+  "version": "55.0.31",
   "description": "Fetches and manages remotely-hosted assets and updates to your app's JS bundle.",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -71,5 +71,5 @@
     "react": "*",
     "react-native": "*"
   },
-  "gitHead": "5defc36eae34b72f7bee8385276200242e5458fe"
+  "gitHead": "167ec74a43d77e1b61f751440334f9e645f8d2be"
 }

package/utils/build/createManifestForBuildAsync.js

@@ -45,12 +45,14 @@ async function createManifestForBuildAsync(platform, projectRoot, destinationDir
         if (!asset.fileHashes) {
             throw new Error('The hashAssetFiles Metro plugin is not configured. You need to add a metro.config.js to your project that configures Metro to use this plugin. See https://github.com/expo/expo/blob/main/packages/expo-updates/README.md#metroconfigjs for an example.');
         }
-        (0, filterPlatformAssetScales_1.filterPlatformAssetScales)(platform, asset.scales).forEach(function (scale, index) {
+        (0, filterPlatformAssetScales_1.filterPlatformAssetScales)(platform, asset.scales).forEach(function (scale) {
             const baseAssetInfoForManifest = {
                 name: asset.name,
                 type: asset.type,
                 scale,
-                packagerHash: asset.fileHashes[index],
+                // `fileHashes` is parallel to the unfiltered `asset.scales`, so it must be indexed by the
+                // scale's position there rather than by its position in the filtered list.
+                packagerHash: asset.fileHashes[asset.scales.indexOf(scale)],
                 subdirectory: asset.httpServerLocation,
             };
             if (platform === 'ios') {

package/utils/src/createManifestForBuildAsync.ts

@@ -64,12 +64,14 @@ export async function createManifestForBuildAsync(
         'The hashAssetFiles Metro plugin is not configured. You need to add a metro.config.js to your project that configures Metro to use this plugin. See https://github.com/expo/expo/blob/main/packages/expo-updates/README.md#metroconfigjs for an example.'
       );
     }
-    filterPlatformAssetScales(platform, asset.scales).forEach(function (scale, index) {
+    filterPlatformAssetScales(platform, asset.scales).forEach(function (scale) {
       const baseAssetInfoForManifest = {
         name: asset.name,
         type: asset.type,
         scale,
-        packagerHash: asset.fileHashes[index],
+        // `fileHashes` is parallel to the unfiltered `asset.scales`, so it must be indexed by the
+        // scale's position there rather than by its position in the filtered list.
+        packagerHash: asset.fileHashes[asset.scales.indexOf(scale)],
         subdirectory: asset.httpServerLocation,
       };
       if (platform === 'ios') {