expo-updates 56.0.24 → 56.0.26

package/CHANGELOG.md

@@ -10,6 +10,33 @@
 
 ### 💡 Others
 
+## 56.0.26 — 2026-08-28
+
+### 🐛 Bug fixes
+
+- [Android] Register the embedded update in a single transaction. An interrupted registration previously left an update row with no launch asset, which is treated as launchable and then fails every cold start with "Launch asset not found for update"; it now leaves no row, so the next launch registers it cleanly. ([#49130](https://github.com/expo/expo/pull/49130) by [@gwdp](https://github.com/gwdp))
+- [Android] Widen `UpdatesLogEntry.create`'s catch from `JSONException` to `Exception` so log-line parse failures consistently degrade to "skip the entry" instead of propagating. ([#46182](https://github.com/expo/expo/pull/46182) by [@jakequade-pc](https://github.com/jakequade-pc))
+- [Android] Correct `UpdatesLogReader.ONE_DAY_MILLISECONDS` from `86400` (seconds) to `86_400_000` (milliseconds), so the "older than one day" purge filter actually retains a day's worth of entries instead of ~86 seconds' worth. ([#46182](https://github.com/expo/expo/pull/46182) by [@jakequade-pc](https://github.com/jakequade-pc))
+- [iOS] Propagate database failures from `addNewAssets` instead of swallowing them, which let an update be marked ready without its launch asset and then fail every launch. ([#49456](https://github.com/expo/expo/pull/49456) by [@alanjhughes](https://github.com/alanjhughes))
+- [iOS] Repair ready updates that are missing their launch asset by demoting them to pending during launcher selection, so a corrupted row is skipped and retried instead of failing every launch. ([#49457](https://github.com/expo/expo/pull/49457) by [@alanjhughes](https://github.com/alanjhughes))
+- [Android] Skip and repair updates that are missing their launch asset instead of selecting them for launch, which previously failed every cold start with "Launch asset not found for update". ([#49470](https://github.com/expo/expo/pull/49470) by [@alanjhughes](https://github.com/alanjhughes), based on [#48733](https://github.com/expo/expo/pull/48733) by [@martintreurnicht](https://github.com/martintreurnicht))
+- [iOS] Fix the embedded manifest recording the wrong `packagerHash` for assets that ship scale variants iOS does not allow (such as `@1.5x` and `@4x`): the hashes were read by the filtered scale index instead of the asset's own, so those images resolved to an empty URI and rendered blank in release builds. ([#48811](https://github.com/expo/expo/pull/48811) by [@expo-bot](https://github.com/expo-bot))
+
+### 💡 Others
+
+- [Android] Replace the "this should never happen" wording in the missing launch asset error with the likely cause and how the state resolves. ([#49130](https://github.com/expo/expo/pull/49130) by [@gwdp](https://github.com/gwdp))
+- [Android] Log purge completion errors via `android.util.Log.e` directly instead of `logger.error`, so the failure path doesn't re-enter the `PersistentFileLog` dispatch queue from inside one of its own tasks. ([#46182](https://github.com/expo/expo/pull/46182) by [@jakequade-pc](https://github.com/jakequade-pc))
+
+## 56.0.25 — 2026-08-17
+
+### 🐛 Bug fixes
+
+- Reject updates whose asset key or file extension contains a path separator, which previously let a manifest write and delete files outside the updates directory. ([#48762](https://github.com/expo/expo/pull/48762), [#48763](https://github.com/expo/expo/pull/48763) by [@alanjhughes](https://github.com/alanjhughes))
+
+### 💡 Others
+
+- [iOS] Link `libc++` in the test spec so the unit test bundle resolves the C++ symbols it pulls from `ExpoModulesCore`. ([#48762](https://github.com/expo/expo/pull/48762) by [@alanjhughes](https://github.com/alanjhughes))
+
 ## 56.0.24 — 2026-08-06
 
 ### 🐛 Bug fixes

package/android/build.gradle

@@ -42,7 +42,7 @@ expoModule {
 }
 
 group = 'host.exp.exponent'
-version = '56.0.24'
+version = '56.0.26'
 
 // Utility method to derive boolean values from the environment or from Java properties,
 // and return them as strings to be used in BuildConfig fields
@@ -89,7 +89,7 @@ android {
   namespace "expo.modules.updates"
   defaultConfig {
     versionCode 31
-    versionName '56.0.24'
+    versionName '56.0.26'
     consumerProguardFiles("proguard-rules.pro")
     testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
 

package/android/src/main/java/expo/modules/updates/EnabledUpdatesController.kt

@@ -4,6 +4,7 @@ import android.app.Activity
 import android.content.Context
 import android.net.Uri
 import android.os.Bundle
+import android.util.Log
 import com.facebook.react.ReactHost
 import com.facebook.react.bridge.ReactContext
 import com.facebook.react.devsupport.interfaces.DevSupportManager
@@ -18,7 +19,6 @@ import expo.modules.updates.events.IUpdatesEventManager
 import expo.modules.updates.events.UpdatesEventManager
 import expo.modules.updates.launcher.Launcher.LauncherCallback
 import expo.modules.updates.loader.FileDownloader
-import expo.modules.updates.logging.UpdatesErrorCode
 import expo.modules.updates.logging.UpdatesLogReader
 import expo.modules.updates.logging.UpdatesLogger
 import expo.modules.updates.manifest.EmbeddedManifestUtils
@@ -90,7 +90,12 @@ class EnabledUpdatesController(
   private fun purgeUpdatesLogsOlderThanOneDay() {
     UpdatesLogReader(context.filesDir).purgeLogEntries {
       if (it != null) {
-        logger.error("UpdatesLogReader: error in purgeLogEntries", it, UpdatesErrorCode.Unknown)
+        // Log directly via android.util.Log rather than through `logger.error`,
+        // which writes via the PersistentFileLog dispatch queue. This callback
+        // is invoked from inside one of that queue's own tasks, so feeding
+        // another entry back into the queue from here re-enters it. Bypassing
+        // the queue keeps the failure path off its own back.
+        Log.e("expo-updates", "UpdatesLogReader: error in purgeLogEntries", it)
       }
     }
   }

package/android/src/main/java/expo/modules/updates/UpdatesUtils.kt

@@ -166,6 +166,17 @@ object UpdatesUtils {
     }
   }
 
+  /**
+   * Asset filenames are built from manifest-controlled values, so a filename holding a path
+   * separator or a `..` component would resolve outside the updates directory.
+   */
+  fun isSafeFilename(filename: String): Boolean {
+    return filename.isNotEmpty() &&
+      filename != "." &&
+      filename != ".." &&
+      filename.none { it == '/' || it == '\\' || it == '\u0000' }
+  }
+
   fun shouldCheckForUpdateOnLaunch(
     updatesConfiguration: UpdatesConfiguration,
     logger: UpdatesLogger,

package/android/src/main/java/expo/modules/updates/db/Reaper.kt

@@ -2,10 +2,12 @@ package expo.modules.updates.db
 
 import android.util.Log
 import expo.modules.updates.UpdatesConfiguration
+import expo.modules.updates.UpdatesUtils
 import expo.modules.updates.db.entity.AssetEntity
 import expo.modules.updates.db.entity.UpdateEntity
 import expo.modules.updates.manifest.ManifestMetadata
 import expo.modules.updates.selectionpolicy.SelectionPolicy
+import expo.modules.updates.utils.AndroidResourceAssetUtils
 import java.io.File
 
 /**
@@ -47,7 +49,20 @@ object Reaper {
         )
         continue
       }
-      val path = File(updatesDirectory, asset.relativePath)
+      val relativePath = asset.relativePath
+      // Embedded assets are served from the APK, so there is no file here to delete.
+      if (relativePath == null || AndroidResourceAssetUtils.isAndroidResourceAsset(relativePath)) {
+        continue
+      }
+      // A row written before asset filenames were validated may point outside the updates directory.
+      if (!UpdatesUtils.isSafeFilename(relativePath)) {
+        Log.e(
+          TAG,
+          "Refusing to delete asset with URL " + asset.url + " at unsafe path " + relativePath
+        )
+        continue
+      }
+      val path = File(updatesDirectory, relativePath)
       try {
         if (path.exists() && !path.delete()) {
           Log.e(TAG, "Failed to delete asset with URL " + asset.url + " at path " + path.toString())

package/android/src/main/java/expo/modules/updates/launcher/DatabaseLauncher.kt

@@ -87,7 +87,7 @@ class DatabaseLauncher(
     // verify that we have all assets on disk
     // according to the database, we should, but something could have gone wrong on disk
     val launchAsset = database.updateDao().loadLaunchAssetForUpdate(launchedUpdate!!.id)
-      ?: throw Exception("Launch asset not found for update; this should never happen. Debug info: ${launchedUpdate!!.debugInfo()}")
+      ?: throw Exception("Launch asset not found for update. The update row has no launch asset; an interrupted registration in an older version of expo-updates can leave an update in this state, and it is replaced once a newer update is downloaded. Debug info: ${launchedUpdate!!.debugInfo()}")
 
     if (launchAsset.relativePath == null) {
       throw Exception("Launch asset relative path should not be null. Debug info: ${launchedUpdate!!.debugInfo()}")
@@ -161,6 +161,15 @@ class DatabaseLauncher(
       if (!configuration.hasEmbeddedUpdate && embeddedUpdate?.updateEntity?.id == update.id) {
         continue
       }
+
+      // An update with no launch asset can never launch. Excluding it here lets the loader
+      // re-run and repair the row instead of failing every cold start.
+      if (update.status != UpdateStatus.DEVELOPMENT &&
+        database.updateDao().loadLaunchAssetForUpdate(update.id) == null
+      ) {
+        logger.warn("Skipping launchable update with no launch asset. Debug info: ${update.debugInfo()}")
+        continue
+      }
       filteredLaunchableUpdates.add(update)
     }
     val manifestFilters = ManifestMetadata.getManifestFilters(database, configuration)

package/android/src/main/java/expo/modules/updates/loader/FileDownloader.kt

@@ -687,6 +687,12 @@ class FileDownloader(
     }
 
     val filename = UpdatesUtils.createFilenameForAsset(asset)
+    if (!UpdatesUtils.isSafeFilename(filename)) {
+      val message = "Failed to download asset ${asset.key}"
+      val error = IOException("Asset filename \"$filename\" would resolve outside the updates directory")
+      logger.error(message, error, UpdatesErrorCode.AssetsFailedToLoad)
+      throw IOException(message, error)
+    }
     val path = File(destinationDirectory, filename)
 
     if (path.exists()) {

package/android/src/main/java/expo/modules/updates/loader/Loader.kt

@@ -1,6 +1,7 @@
 package expo.modules.updates.loader
 
 import android.content.Context
+import androidx.room.withTransaction
 import expo.modules.updates.UpdatesConfiguration
 import expo.modules.updates.UpdatesUtils
 import expo.modules.updates.db.UpdatesDatabase
@@ -17,6 +18,7 @@ import expo.modules.updates.logging.UpdatesErrorCode
 import expo.modules.updates.logging.UpdatesLogger
 import expo.modules.updates.manifest.ManifestMetadata
 import expo.modules.updates.manifest.Update
+import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
@@ -164,21 +166,32 @@ abstract class Loader protected constructor(
       database.updateDao().setUpdateScopeKey(existingUpdateEntity, newUpdateEntity.scopeKey)
     }
 
-    if (existingUpdateEntity != null && existingUpdateEntity.status == UpdateStatus.READY) {
+    // A READY update with no launch asset is not actually ready. Fall through to
+    // downloadAllAssets so its assets are re-registered instead of staying broken forever.
+    if (existingUpdateEntity != null && existingUpdateEntity.status == UpdateStatus.READY &&
+      database.updateDao().loadLaunchAssetForUpdate(existingUpdateEntity.id) != null
+    ) {
       // hooray, we already have this update downloaded and ready to go!
       updateEntity = existingUpdateEntity
       return finish()
     } else {
+      val insertUpdateEntityOnFinish: Boolean
       if (existingUpdateEntity == null) {
-        // no update already exists with this ID, so we need to insert it and download everything.
+        // no update already exists with this ID, so we need to download everything.
         updateEntity = newUpdateEntity
-        database.updateDao().insertUpdate(updateEntity!!)
+        // EMBEDDED is already in the launchable set, so a row inserted before its launch asset exists
+        // gets picked as launchable and then fails every launch.
+        insertUpdateEntityOnFinish = newUpdateEntity.status == UpdateStatus.EMBEDDED
+        if (!insertUpdateEntityOnFinish) {
+          database.updateDao().insertUpdate(updateEntity!!)
+        }
       } else {
         // we've already partially downloaded the update, so we should use the existing entity.
         // however, it's not ready, so we should try to download all the assets again.
         updateEntity = existingUpdateEntity
+        insertUpdateEntityOnFinish = false
       }
-      return downloadAllAssets(update)
+      return downloadAllAssets(update, insertUpdateEntityOnFinish)
     }
   }
 
@@ -188,7 +201,7 @@ abstract class Loader protected constructor(
     ERRORED
   }
 
-  private suspend fun downloadAllAssets(update: Update): LoaderResult {
+  private suspend fun downloadAllAssets(update: Update, insertUpdateEntityOnFinish: Boolean): LoaderResult {
     val assetList = update.assetEntityList.distinctBy { it.key }
     assetTotal = assetList.size
 
@@ -235,26 +248,34 @@ abstract class Loader protected constructor(
     assetDownloadJobs.awaitAll()
 
     try {
-      for (asset in existingAssetList) {
-        val existingAssetFound = database.assetDao()
-          .addExistingAssetToUpdate(updateEntity!!, asset, asset.isLaunchAsset)
-        if (!existingAssetFound) {
-          // the database and filesystem have gotten out of sync
-          // do our best to create a new entry for this file even though it already existed on disk
-          // TODO: we should probably get rid of this assumption that if an asset exists on disk with the same filename, it's the same asset
-          var hash: ByteArray? = null
-          try {
-            hash = UpdatesUtils.sha256(File(updatesDirectory, asset.relativePath))
-          } catch (_: Exception) {
+      database.withTransaction {
+        if (insertUpdateEntityOnFinish) {
+          database.updateDao().insertUpdate(updateEntity!!)
+        }
+
+        for (asset in existingAssetList) {
+          val existingAssetFound = database.assetDao()
+            .addExistingAssetToUpdate(updateEntity!!, asset, asset.isLaunchAsset)
+          if (!existingAssetFound) {
+            // the database and filesystem have gotten out of sync
+            // do our best to create a new entry for this file even though it already existed on disk
+            // TODO: we should probably get rid of this assumption that if an asset exists on disk with the same filename, it's the same asset
+            var hash: ByteArray? = null
+            try {
+              hash = UpdatesUtils.sha256(File(updatesDirectory, asset.relativePath))
+            } catch (_: Exception) {
+            }
+            asset.downloadTime = Date()
+            asset.hash = hash
+            finishedAssetList.add(asset)
           }
-          asset.downloadTime = Date()
-          asset.hash = hash
-          finishedAssetList.add(asset)
         }
-      }
 
-      database.assetDao().insertAssets(finishedAssetList, updateEntity!!)
-      database.updateDao().markUpdateFinished(updateEntity!!)
+        database.assetDao().insertAssets(finishedAssetList, updateEntity!!)
+        database.updateDao().markUpdateFinished(updateEntity!!)
+      }
+    } catch (e: CancellationException) {
+      throw e
     } catch (e: Exception) {
       throw IOException("Error while adding new update to database", e)
     }

package/android/src/main/java/expo/modules/updates/logging/UpdatesLogEntry.kt

@@ -3,7 +3,6 @@ package expo.modules.updates.logging
 import expo.modules.jsonutils.getNullable
 import expo.modules.jsonutils.require
 import org.json.JSONArray
-import org.json.JSONException
 import org.json.JSONObject
 
 /**
@@ -59,7 +58,11 @@ data class UpdatesLogEntry(
             List(jsonArray.length()) { i -> jsonArray.getString(i) }
           }
         )
-      } catch (e: JSONException) {
+      } catch (e: Exception) {
+        // `JSONObject.require<T>` can surface a ClassCastException via a blind
+        // cast in the catch-all branch (e.g. an int-sized numeric `duration`
+        // token surfaces as `Integer`), which would otherwise escape and
+        // propagate to the caller.
         null
       }
     }

package/android/src/main/java/expo/modules/updates/logging/UpdatesLogReader.kt

@@ -54,6 +54,6 @@ class UpdatesLogReader(
   }
 
   companion object {
-    private const val ONE_DAY_MILLISECONDS = 86400
+    private const val ONE_DAY_MILLISECONDS = 86_400_000L
   }
 }

package/android/src/main/java/expo/modules/updates/manifest/ExpoUpdatesUpdate.kt

@@ -14,6 +14,7 @@ import expo.modules.updates.db.enums.UpdateStatus
 import org.json.JSONArray
 import org.json.JSONException
 import org.json.JSONObject
+import java.io.IOException
 import java.text.ParseException
 import java.util.*
 
@@ -95,27 +96,43 @@ class ExpoUpdatesUpdate private constructor(
   companion object {
     private val TAG = Update::class.java.simpleName
 
-    @Throws(JSONException::class)
+    @Throws(Exception::class)
     fun fromExpoUpdatesManifest(
       manifest: ExpoUpdatesManifest,
       extensions: JSONObject?,
       configuration: UpdatesConfiguration
-    ): ExpoUpdatesUpdate = ExpoUpdatesUpdate(
-      manifest,
-      id = UUID.fromString(manifest.getID()),
-      configuration.scopeKey,
-      commitTime = try {
-        UpdatesUtils.parseDateString(manifest.getCreatedAt())
-      } catch (e: ParseException) {
-        Log.e(TAG, "Could not parse manifest createdAt string; falling back to current time", e)
-        Date()
-      },
-      runtimeVersion = manifest.getRuntimeVersion(),
-      launchAsset = manifest.getLaunchAsset(),
-      assets = manifest.getAssets(),
-      extensions = extensions,
-      url = configuration.updateUrl,
-      requestHeaders = configuration.requestHeaders
-    )
+    ): ExpoUpdatesUpdate {
+      val update = ExpoUpdatesUpdate(
+        manifest,
+        id = UUID.fromString(manifest.getID()),
+        configuration.scopeKey,
+        commitTime = try {
+          UpdatesUtils.parseDateString(manifest.getCreatedAt())
+        } catch (e: ParseException) {
+          Log.e(TAG, "Could not parse manifest createdAt string; falling back to current time", e)
+          Date()
+        },
+        runtimeVersion = manifest.getRuntimeVersion(),
+        launchAsset = manifest.getLaunchAsset(),
+        assets = manifest.getAssets(),
+        extensions = extensions,
+        url = configuration.updateUrl,
+        requestHeaders = configuration.requestHeaders
+      )
+
+      update.assetEntityList.forEach { asset ->
+        val filename = UpdatesUtils.createFilenameForAsset(asset)
+        if (!UpdatesUtils.isSafeFilename(filename)) {
+          throw IOException(
+            "Update ${manifest.getID()} could not be loaded because the asset filename " +
+              "\"$filename\" is not a valid filename. Assets are stored under their key and file " +
+              "extension, so neither may contain a path separator. Check the server that produced " +
+              "this manifest."
+          )
+        }
+      }
+
+      return update
+    }
   }
 }

package/ios/EXUpdates/AppLauncher/AppLauncherWithDatabase.swift

@@ -32,6 +32,11 @@ public class AppLauncherWithDatabase: NSObject, AppLauncher {
   public var launchAssetUrl: URL?
   public var assetFilesMap: [String: String]?
 
+  /// Set when the launched update is served directly from the embedded app binary. Tracked
+  /// explicitly because `assetFilesMap` is now populated with the bundle-resolved embedded assets,
+  /// so it can no longer double as the "using embedded assets" signal.
+  private var launchedFromEmbeddedBundle = false
+
   private let launcherQueue: DispatchQueue
   private var completedAssets: Int
   private let config: UpdatesConfig
@@ -54,7 +59,7 @@ public class AppLauncherWithDatabase: NSObject, AppLauncher {
   }
 
   public func isUsingEmbeddedAssets() -> Bool {
-    return assetFilesMap == nil
+    return launchedFromEmbeddedBundle
   }
 
   public static func launchableUpdate(
@@ -178,7 +183,10 @@ public class AppLauncherWithDatabase: NSObject, AppLauncher {
     }
 
     if launchedUpdate.status == UpdateStatus.StatusEmbedded {
-      precondition(assetFilesMap == nil, "assetFilesMap should be null for embedded updates")
+      launchedFromEmbeddedBundle = true
+      // The embedded update's assets aren't copied into the cache, so resolve them from the app
+      // binary. Populating the map here keeps `Updates.localAssets` available instead of empty.
+      assetFilesMap = UpdatesUtils.embeddedAssetsMap(withConfig: config, database: database, logger: logger)
       launchAssetUrl = updatesBundle.url(
         forResource: EmbeddedAppLoader.EXUpdatesBareEmbeddedBundleFilename,
         withExtension: EmbeddedAppLoader.EXUpdatesBareEmbeddedBundleFileType

package/ios/EXUpdates/AppLoader/EmbeddedAppLoader.swift

@@ -8,14 +8,12 @@
 import Foundation
 
 /**
- * Subclass of AppLoader which handles copying the embedded update's assets into the
- * expo-updates cache location.
+ * Subclass of AppLoader which loads the embedded update.
  *
- * Rather than launching the embedded update directly from its location in the app bundle/apk, we
- * first try to read it into the expo-updates cache and database and launch it like any other
- * update. The benefits of this include (a) a single code path for launching most updates and (b)
- * assets included in embedded updates and copied into the cache in this way do not need to be
- * redownloaded if included in future updates.
+ * By default (`EX_UPDATES_COPY_EMBEDDED_ASSETS` off) the update is registered but its assets aren't
+ * read into the database; it keeps StatusEmbedded and launches from the app binary, so first launch
+ * stays fast. When the flag is on, assets are read into the database and it launches like any other
+ * update, so a later update reusing them avoids a redownload.
  */
 @objc(EXUpdatesEmbeddedAppLoader)
 @objcMembers
@@ -29,6 +27,24 @@ public final class EmbeddedAppLoader: AppLoader {
 
   private static var embeddedManifestInternal: EmbeddedUpdate?
 
+  /// Whether to read and hash embedded assets into the database on first launch. Defaults to the
+  /// build-time `EX_UPDATES_COPY_EMBEDDED_ASSETS` flag (off). Overridable for testing.
+  internal var shouldCopyEmbeddedAssets: Bool = UpdatesUtils.shouldCopyEmbeddedAssets()
+
+  internal let completionQueue: DispatchQueue
+
+  public required override init(
+    config: UpdatesConfig,
+    logger: UpdatesLogger,
+    database: UpdatesDatabase,
+    directory: URL,
+    launchedUpdate: Update?,
+    completionQueue: DispatchQueue
+  ) {
+    self.completionQueue = completionQueue
+    super.init(config: config, logger: logger, database: database, directory: directory, launchedUpdate: launchedUpdate, completionQueue: completionQueue)
+  }
+
   /**
    Gets the embedded update.
    If the `UpdatesConfig.hasEmbeddedUpdate` is false, it returns nil
@@ -136,6 +152,18 @@ public final class EmbeddedAppLoader: AppLoader {
     self.assetBlock = assetBlock
     self.successBlock = successBlock
     self.errorBlock = errorBlock
+    startEmbeddedLoad(fromEmbeddedManifest: embeddedManifest)
+  }
+
+  /// Loads the embedded update: with copying off (default) registers it without ingesting assets,
+  /// otherwise loads them like any other update. Separate from `loadUpdateResponseFromEmbeddedManifest`
+  /// so tests can pass a manifest without reading the bundle.
+  internal func startEmbeddedLoad(fromEmbeddedManifest embeddedManifest: Update) {
+    if !shouldCopyEmbeddedAssets {
+      registerEmbeddedUpdateWithoutCopying(embeddedManifest)
+      return
+    }
+
     startLoading(fromUpdateResponse: UpdateResponse(
       responseHeaderData: nil,
       manifestUpdateResponsePart: ManifestUpdateResponsePart(updateManifest: embeddedManifest),
@@ -143,6 +171,40 @@ public final class EmbeddedAppLoader: AppLoader {
     ))
   }
 
+  /// Registers the embedded update without reading, hashing, or copying its assets. A StatusEmbedded
+  /// update resolves its bundle and assets from the app binary at launch. Tradeoff: a future update
+  /// reusing an embedded asset re-downloads it.
+  private func registerEmbeddedUpdateWithoutCopying(_ embeddedManifest: Update) {
+    database.databaseQueue.async {
+      do {
+        let existingUpdate = try? self.database.update(withId: embeddedManifest.updateId, config: self.config)
+        if existingUpdate == nil {
+          try self.database.addUpdate(embeddedManifest, config: self.config)
+        }
+        // Mark finished (keep = 1) so the reaper retains it; it stays StatusEmbedded since copying is off.
+        try self.database.markUpdateFinished(embeddedManifest)
+      } catch {
+        let errorBlock = self.errorBlock
+        self.completionQueue.async {
+          errorBlock?(UpdatesError.appLoaderUnknownError(cause: error))
+          self.reset()
+        }
+        return
+      }
+
+      let successBlock = self.successBlock
+      let updateResponse = UpdateResponse(
+        responseHeaderData: nil,
+        manifestUpdateResponsePart: ManifestUpdateResponsePart(updateManifest: embeddedManifest),
+        directiveUpdateResponsePart: nil
+      )
+      self.completionQueue.async {
+        successBlock?(updateResponse)
+        self.reset()
+      }
+    }
+  }
+
   override public func downloadAsset(_ asset: UpdateAsset, extraHeaders: [String: Any]) {
     FileDownloader.assetFilesQueue.async {
       self.handleAssetDownloadAlreadyExists(asset)

package/ios/EXUpdates/AppLoader/RemoteAppLoader.swift

@@ -105,6 +105,13 @@ public final class RemoteAppLoader: AppLoader {
   }
 
   override public func downloadAsset(_ asset: UpdateAsset, extraHeaders: [String: Any]) {
+    guard UpdatesUtils.isSafeFilename(asset.filename) else {
+      self.handleAssetDownload(
+        withError: UpdatesError.remoteAppLoaderUnsafeAssetFilename(filename: asset.filename),
+        asset: asset
+      )
+      return
+    }
     let urlOnDisk = self.directory.appendingPathComponent(asset.filename)
 
     let progressBlock = { [weak self] fractionCompleted in

package/ios/EXUpdates/Database/UpdatesDatabase.swift

@@ -160,7 +160,7 @@ public final class UpdatesDatabase: NSObject {
         )
       } catch {
         sqlite3_exec(db, "ROLLBACK;", nil, nil, nil)
-        return
+        throw error
       }
 
       // statements must stay in precisely this order for last_insert_rowid() to work correctly
@@ -170,7 +170,7 @@ public final class UpdatesDatabase: NSObject {
           _ = try execute(sql: updateSql, withArgs: [updateId])
         } catch {
           sqlite3_exec(db, "ROLLBACK;", nil, nil, nil)
-          return
+          throw error
         }
       }
 
@@ -181,7 +181,7 @@ public final class UpdatesDatabase: NSObject {
         _ = try execute(sql: updateInsertSql, withArgs: [updateId])
       } catch {
         sqlite3_exec(db, "ROLLBACK;", nil, nil, nil)
-        return
+        throw error
       }
     }
 
@@ -280,7 +280,11 @@ public final class UpdatesDatabase: NSObject {
   }
 
   public func markUpdateFinished(_ update: Update) throws {
-    if update.status != UpdateStatus.StatusDevelopment {
+    // With copying off, embedded updates have no asset rows, so they must stay StatusEmbedded to keep
+    // launching from the bundle. Promoting to StatusReady would route launch through the database
+    // asset path, which has no rows for them.
+    let keepEmbedded = update.status == UpdateStatus.StatusEmbedded && !UpdatesUtils.shouldCopyEmbeddedAssets()
+    if update.status != UpdateStatus.StatusDevelopment && !keepEmbedded {
       update.status = UpdateStatus.StatusReady
     }
 
@@ -440,7 +444,23 @@ public final class UpdatesDatabase: NSObject {
     )
 
     let rows = try execute(sql: sql, withArgs: [config.scopeKey])
-    return rows.map { row in
+
+    // A ready row with no launch asset is corrupt (e.g. from an interrupted registration) and
+    // would fail every launch. Demote it for the loader to retry instead of offering it.
+    var launchableRows: [[String: Any?]] = []
+    for row in rows {
+      let status: NSNumber = row.requiredValue(forKey: "status")
+      let launchAssetId: NSNumber? = row.optionalValue(forKey: "launch_asset_id")
+      if status.intValue == UpdateStatus.StatusReady.rawValue && launchAssetId == nil {
+        let updateId: UUID = row.requiredValue(forKey: "id")
+        let demoteSql = "UPDATE updates SET status = ?1 WHERE id = ?2;"
+        _ = try execute(sql: demoteSql, withArgs: [UpdateStatus.StatusPending.rawValue, updateId])
+      } else {
+        launchableRows.append(row)
+      }
+    }
+
+    return launchableRows.map { row in
       update(withRow: row, config: config)
     }
   }

package/ios/EXUpdates/Database/UpdatesReaper.swift

@@ -71,6 +71,10 @@ public final class UpdatesReaper: NSObject {
 
         let beginDeleteAssets = Date()
         for asset in assetsForDeletion {
+          guard UpdatesUtils.isSafeFilename(asset.filename) else {
+            logger.warn(message: "Refusing to delete asset at unsafe path \(asset.filename)")
+            continue
+          }
           let localUrl = directory.appendingPathComponent(asset.filename)
           if FileManager.default.fileExists(atPath: localUrl.path) {
             do {

package/ios/EXUpdates/Update/Update.swift

@@ -77,6 +77,7 @@ public enum UpdateStatus: Int {
 public enum UpdateError: Error, Sendable, LocalizedError {
   case invalidExpoProtocolVersion(protocolVersion: Int)
   case legacyManifestInstantiationInvalid
+  case unsafeAssetFilename(updateId: String, filename: String)
 
   public var errorDescription: String? {
     switch self {
@@ -84,6 +85,10 @@ public enum UpdateError: Error, Sendable, LocalizedError {
       return "Invalid Expo Updates protocol version: \(protocolVersion)"
     case .legacyManifestInstantiationInvalid:
       return "This version of expo-updates can no longer load legacy manifests"
+    case let .unsafeAssetFilename(updateId, filename):
+      return "Update \(updateId) could not be loaded because the asset filename \"\(filename)\" " +
+        "is not a valid filename. Assets are stored under their key and file extension, so neither " +
+        "may contain a path separator. Check the server that produced this manifest."
     }
   }
 }
@@ -157,12 +162,21 @@ public class Update: NSObject {
     }
     switch protocolVersion {
     case 0, 1:
-      return ExpoUpdatesUpdate.update(
+      let update = ExpoUpdatesUpdate.update(
         withExpoUpdatesManifest: ExpoUpdatesManifest(rawManifestJSON: withManifest),
         extensions: extensions,
         config: config,
         database: database
       )
+      try update.assets()?.forEach { asset in
+        guard UpdatesUtils.isSafeFilename(asset.filename) else {
+          throw UpdateError.unsafeAssetFilename(
+            updateId: update.updateId.uuidString,
+            filename: asset.filename
+          )
+        }
+      }
+      return update
     default:
       throw UpdateError.invalidExpoProtocolVersion(protocolVersion: protocolVersion)
     }

package/ios/EXUpdates/UpdatesError.swift

@@ -26,6 +26,7 @@ public enum UpdatesError: Error, Sendable, LocalizedError {
   case fileDownloaderFailedUpdateIDsFailure(cause: Error)
   case fileDownloaderUnknownError(cause: Error)
   case remoteAppLoaderAssetMissingUrl
+  case remoteAppLoaderUnsafeAssetFilename(filename: String)
   case remoteAppLoaderHeaderDataError(cause: Error)
   case remoteAppLoaderUnknownError(cause: Error)
   case appLoaderFailedToLoadAllAssets
@@ -92,6 +93,8 @@ public enum UpdatesError: Error, Sendable, LocalizedError {
       return "Unknown error: \(cause.localizedDescription)"
     case .remoteAppLoaderAssetMissingUrl:
       return "Failed to download asset with no URL provided"
+    case let .remoteAppLoaderUnsafeAssetFilename(filename):
+      return "Failed to download asset: filename \"\(filename)\" would resolve outside the updates directory"
     case let .remoteAppLoaderHeaderDataError(cause):
       return "Error persisting header data to disk: \(cause.localizedDescription)"
     case .appLoaderFailedToLoadAllAssets:

package/ios/EXUpdates/UpdatesUtils.swift

@@ -75,6 +75,23 @@ public final class UpdatesUtils: NSObject {
     return updatesDirectory
   }
 
+  /**
+   * Asset filenames are built from manifest-controlled values, so a filename holding a path
+   * separator or a `..` component would resolve outside the updates directory.
+   *
+   * Matching is done on unicode scalars because `String.contains` compares grapheme clusters, and
+   * a separator followed by a combining mark forms one cluster that does not equal the separator.
+   * The filesystem still sees the separator byte.
+   */
+  public static func isSafeFilename(_ filename: String) -> Bool {
+    return !filename.isEmpty &&
+      filename != "." &&
+      filename != ".." &&
+      !filename.unicodeScalars.contains("/") &&
+      !filename.unicodeScalars.contains("\\") &&
+      !filename.unicodeScalars.contains("\0")
+  }
+
   // MARK: - Internal methods
 
   public static func defaultNativeStateMachineContextJson() -> [String: Any?] {
@@ -165,6 +182,14 @@ public final class UpdatesUtils: NSObject {
 #endif
   }
 
+  internal static func shouldCopyEmbeddedAssets() -> Bool {
+#if EX_UPDATES_COPY_EMBEDDED_ASSETS
+    return true
+#else
+    return false
+#endif
+  }
+
   internal static func runBlockOnMainThread(_ block: @escaping () -> Void) {
     if Thread.isMainThread {
       block()

package/ios/EXUpdates.podspec

@@ -9,6 +9,9 @@ end
 if ENV['EX_UPDATES_CUSTOM_INIT'] != '1'
   ENV['EX_UPDATES_CUSTOM_INIT'] = podfile_properties['updatesCustomInit'] == 'true' ? '1' : '0'
 end
+if ENV['EX_UPDATES_COPY_EMBEDDED_ASSETS'] != '1'
+  ENV['EX_UPDATES_COPY_EMBEDDED_ASSETS'] = podfile_properties['updatesCopyEmbeddedAssets'] == 'true' ? '1' : '0'
+end
 
 use_dev_client = false
 begin
@@ -72,6 +75,7 @@ Pod::Spec.new do |s|
 
   ex_updates_native_debug = ENV['EX_UPDATES_NATIVE_DEBUG'] == '1'
   ex_updates_custom_init = ENV['EX_UPDATES_CUSTOM_INIT'] == '1'
+  ex_updates_copy_embedded_assets = ENV['EX_UPDATES_COPY_EMBEDDED_ASSETS'] == '1'
   if ex_updates_native_debug
     other_debug_c_flags << ' -DEX_UPDATES_NATIVE_DEBUG=1'
     other_debug_swift_flags << ' -DEX_UPDATES_NATIVE_DEBUG'
@@ -82,6 +86,12 @@ Pod::Spec.new do |s|
     other_release_c_flags << ' -DEX_UPDATES_CUSTOM_INIT=1'
     other_release_swift_flags << ' -DEX_UPDATES_CUSTOM_INIT'
   end
+  if ex_updates_copy_embedded_assets
+    other_debug_c_flags << ' -DEX_UPDATES_COPY_EMBEDDED_ASSETS=1'
+    other_debug_swift_flags << ' -DEX_UPDATES_COPY_EMBEDDED_ASSETS'
+    other_release_c_flags << ' -DEX_UPDATES_COPY_EMBEDDED_ASSETS=1'
+    other_release_swift_flags << ' -DEX_UPDATES_COPY_EMBEDDED_ASSETS'
+  end
   if use_dev_client
     other_debug_c_flags << ' -DUSE_DEV_CLIENT=1'
     other_debug_swift_flags << ' -DUSE_DEV_CLIENT'
@@ -141,6 +151,7 @@ Pod::Spec.new do |s|
     test_spec.dependency 'ExpoModulesTestCore'
 
     test_spec.pod_target_xcconfig = {
+      'OTHER_LDFLAGS' => '$(inherited) -lc++',
       'USER_HEADER_SEARCH_PATHS' => '"${CONFIGURATION_TEMP_DIR}/EXUpdates.build/DerivedSources"',
       'GCC_TREAT_INCOMPATIBLE_POINTER_TYPE_WARNINGS_AS_ERRORS' => 'YES',
       'GCC_TREAT_IMPLICIT_FUNCTION_DECLARATIONS_AS_ERRORS' => 'YES',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-updates",
-  "version": "56.0.24",
+  "version": "56.0.26",
   "description": "Fetches and manages remotely-hosted assets and updates to your app's JS bundle.",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -60,10 +60,10 @@
     "picomatch": "^4.0.4",
     "ts-node": "^10.9.2",
     "xstate": "^4.37.2",
-    "expo": "56.0.19",
-    "expo-dev-client": "56.0.24",
-    "@expo/metro-config": "56.0.18",
-    "expo-module-scripts": "56.0.3"
+    "expo": "56.0.21",
+    "@expo/metro-config": "56.0.19",
+    "expo-module-scripts": "56.0.3",
+    "expo-dev-client": "56.0.26"
   },
   "peerDependencies": {
     "expo": "*",
@@ -82,7 +82,7 @@
       "./scripts/with-node.sh"
     ]
   },
-  "gitHead": "eebecc21d8d868d97e72bd61bb8e668fb2feb704",
+  "gitHead": "1b8eb0e13635d3ef52c1c11d305ff927d01390ae",
   "scripts": {
     "build": "expo-module build",
     "clean": "expo-module clean",

package/utils/src/createManifestForBuildAsync.ts

@@ -64,12 +64,14 @@ export async function createManifestForBuildAsync(
         'The hashAssetFiles Metro plugin is not configured. You need to add a metro.config.js to your project that configures Metro to use this plugin. See https://github.com/expo/expo/blob/main/packages/expo-updates/README.md#metroconfigjs for an example.'
       );
     }
-    filterPlatformAssetScales(platform, asset.scales).forEach(function (scale, index) {
+    filterPlatformAssetScales(platform, asset.scales).forEach(function (scale) {
       const baseAssetInfoForManifest = {
         name: asset.name,
         type: asset.type,
         scale,
-        packagerHash: asset.fileHashes[index],
+        // `fileHashes` is parallel to the unfiltered `asset.scales`, so it must be indexed by the
+        // scale's position there rather than by its position in the filtered list.
+        packagerHash: asset.fileHashes[asset.scales.indexOf(scale)],
         subdirectory: asset.httpServerLocation,
       };
       if (platform === 'ios') {