expo-updates 57.0.12 → 57.0.14

package/CHANGELOG.md

@@ -10,6 +10,20 @@
 
 ### 💡 Others
 
+## 57.0.14 — 2026-08-14
+
+### 🐛 Bug fixes
+
+- Reject updates whose asset key or file extension contains a path separator, which previously let a manifest write and delete files outside the updates directory. ([#48762](https://github.com/expo/expo/pull/48762), [#48763](https://github.com/expo/expo/pull/48763) by [@alanjhughes](https://github.com/alanjhughes))
+
+### 💡 Others
+
+- [iOS] Link `libc++` in the test spec so the unit test bundle resolves the C++ symbols it pulls from `ExpoModulesCore`. ([#48762](https://github.com/expo/expo/pull/48762) by [@alanjhughes](https://github.com/alanjhughes))
+
+## 57.0.13 — 2026-08-10
+
+_This version does not introduce any user-facing changes._
+
 ## 57.0.12 — 2026-08-04
 
 ### 🐛 Bug fixes

package/android/build.gradle

@@ -42,7 +42,7 @@ expoModule {
 }
 
 group = 'host.exp.exponent'
-version = '57.0.12'
+version = '57.0.14'
 
 // Utility method to derive boolean values from the environment or from Java properties,
 // and return them as strings to be used in BuildConfig fields
@@ -89,7 +89,7 @@ android {
   namespace "expo.modules.updates"
   defaultConfig {
     versionCode 31
-    versionName '57.0.12'
+    versionName '57.0.14'
     consumerProguardFiles("proguard-rules.pro")
     testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
 

package/android/src/main/java/expo/modules/updates/UpdatesUtils.kt

@@ -166,6 +166,17 @@ object UpdatesUtils {
     }
   }
 
+  /**
+   * Asset filenames are built from manifest-controlled values, so a filename holding a path
+   * separator or a `..` component would resolve outside the updates directory.
+   */
+  fun isSafeFilename(filename: String): Boolean {
+    return filename.isNotEmpty() &&
+      filename != "." &&
+      filename != ".." &&
+      filename.none { it == '/' || it == '\\' || it == '\u0000' }
+  }
+
   fun shouldCheckForUpdateOnLaunch(
     updatesConfiguration: UpdatesConfiguration,
     logger: UpdatesLogger,

package/android/src/main/java/expo/modules/updates/db/Reaper.kt

@@ -2,10 +2,12 @@ package expo.modules.updates.db
 
 import android.util.Log
 import expo.modules.updates.UpdatesConfiguration
+import expo.modules.updates.UpdatesUtils
 import expo.modules.updates.db.entity.AssetEntity
 import expo.modules.updates.db.entity.UpdateEntity
 import expo.modules.updates.manifest.ManifestMetadata
 import expo.modules.updates.selectionpolicy.SelectionPolicy
+import expo.modules.updates.utils.AndroidResourceAssetUtils
 import java.io.File
 
 /**
@@ -47,7 +49,20 @@ object Reaper {
         )
         continue
       }
-      val path = File(updatesDirectory, asset.relativePath)
+      val relativePath = asset.relativePath
+      // Embedded assets are served from the APK, so there is no file here to delete.
+      if (relativePath == null || AndroidResourceAssetUtils.isAndroidResourceAsset(relativePath)) {
+        continue
+      }
+      // A row written before asset filenames were validated may point outside the updates directory.
+      if (!UpdatesUtils.isSafeFilename(relativePath)) {
+        Log.e(
+          TAG,
+          "Refusing to delete asset with URL " + asset.url + " at unsafe path " + relativePath
+        )
+        continue
+      }
+      val path = File(updatesDirectory, relativePath)
       try {
         if (path.exists() && !path.delete()) {
           Log.e(TAG, "Failed to delete asset with URL " + asset.url + " at path " + path.toString())

package/android/src/main/java/expo/modules/updates/loader/FileDownloader.kt

@@ -687,6 +687,12 @@ class FileDownloader(
     }
 
     val filename = UpdatesUtils.createFilenameForAsset(asset)
+    if (!UpdatesUtils.isSafeFilename(filename)) {
+      val message = "Failed to download asset ${asset.key}"
+      val error = IOException("Asset filename \"$filename\" would resolve outside the updates directory")
+      logger.error(message, error, UpdatesErrorCode.AssetsFailedToLoad)
+      throw IOException(message, error)
+    }
     val path = File(destinationDirectory, filename)
 
     if (path.exists()) {

package/android/src/main/java/expo/modules/updates/manifest/ExpoUpdatesUpdate.kt

@@ -14,6 +14,7 @@ import expo.modules.updates.db.enums.UpdateStatus
 import org.json.JSONArray
 import org.json.JSONException
 import org.json.JSONObject
+import java.io.IOException
 import java.text.ParseException
 import java.util.*
 
@@ -95,27 +96,43 @@ class ExpoUpdatesUpdate private constructor(
   companion object {
     private val TAG = Update::class.java.simpleName
 
-    @Throws(JSONException::class)
+    @Throws(Exception::class)
     fun fromExpoUpdatesManifest(
       manifest: ExpoUpdatesManifest,
       extensions: JSONObject?,
       configuration: UpdatesConfiguration
-    ): ExpoUpdatesUpdate = ExpoUpdatesUpdate(
-      manifest,
-      id = UUID.fromString(manifest.getID()),
-      configuration.scopeKey,
-      commitTime = try {
-        UpdatesUtils.parseDateString(manifest.getCreatedAt())
-      } catch (e: ParseException) {
-        Log.e(TAG, "Could not parse manifest createdAt string; falling back to current time", e)
-        Date()
-      },
-      runtimeVersion = manifest.getRuntimeVersion(),
-      launchAsset = manifest.getLaunchAsset(),
-      assets = manifest.getAssets(),
-      extensions = extensions,
-      url = configuration.updateUrl,
-      requestHeaders = configuration.requestHeaders
-    )
+    ): ExpoUpdatesUpdate {
+      val update = ExpoUpdatesUpdate(
+        manifest,
+        id = UUID.fromString(manifest.getID()),
+        configuration.scopeKey,
+        commitTime = try {
+          UpdatesUtils.parseDateString(manifest.getCreatedAt())
+        } catch (e: ParseException) {
+          Log.e(TAG, "Could not parse manifest createdAt string; falling back to current time", e)
+          Date()
+        },
+        runtimeVersion = manifest.getRuntimeVersion(),
+        launchAsset = manifest.getLaunchAsset(),
+        assets = manifest.getAssets(),
+        extensions = extensions,
+        url = configuration.updateUrl,
+        requestHeaders = configuration.requestHeaders
+      )
+
+      update.assetEntityList.forEach { asset ->
+        val filename = UpdatesUtils.createFilenameForAsset(asset)
+        if (!UpdatesUtils.isSafeFilename(filename)) {
+          throw IOException(
+            "Update ${manifest.getID()} could not be loaded because the asset filename " +
+              "\"$filename\" is not a valid filename. Assets are stored under their key and file " +
+              "extension, so neither may contain a path separator. Check the server that produced " +
+              "this manifest."
+          )
+        }
+      }
+
+      return update
+    }
   }
 }

package/ios/EXUpdates/AppLoader/RemoteAppLoader.swift

@@ -105,6 +105,13 @@ public final class RemoteAppLoader: AppLoader {
   }
 
   override public func downloadAsset(_ asset: UpdateAsset, extraHeaders: [String: Any]) {
+    guard UpdatesUtils.isSafeFilename(asset.filename) else {
+      self.handleAssetDownload(
+        withError: UpdatesError.remoteAppLoaderUnsafeAssetFilename(filename: asset.filename),
+        asset: asset
+      )
+      return
+    }
     let urlOnDisk = self.directory.appendingPathComponent(asset.filename)
 
     let progressBlock = { [weak self] fractionCompleted in

package/ios/EXUpdates/Database/UpdatesReaper.swift

@@ -71,6 +71,10 @@ public final class UpdatesReaper: NSObject {
 
         let beginDeleteAssets = Date()
         for asset in assetsForDeletion {
+          guard UpdatesUtils.isSafeFilename(asset.filename) else {
+            logger.warn(message: "Refusing to delete asset at unsafe path \(asset.filename)")
+            continue
+          }
           let localUrl = directory.appendingPathComponent(asset.filename)
           if FileManager.default.fileExists(atPath: localUrl.path) {
             do {

package/ios/EXUpdates/Update/Update.swift

@@ -77,6 +77,7 @@ public enum UpdateStatus: Int {
 public enum UpdateError: Error, Sendable, LocalizedError {
   case invalidExpoProtocolVersion(protocolVersion: Int)
   case legacyManifestInstantiationInvalid
+  case unsafeAssetFilename(updateId: String, filename: String)
 
   public var errorDescription: String? {
     switch self {
@@ -84,6 +85,10 @@ public enum UpdateError: Error, Sendable, LocalizedError {
       return "Invalid Expo Updates protocol version: \(protocolVersion)"
     case .legacyManifestInstantiationInvalid:
       return "This version of expo-updates can no longer load legacy manifests"
+    case let .unsafeAssetFilename(updateId, filename):
+      return "Update \(updateId) could not be loaded because the asset filename \"\(filename)\" " +
+        "is not a valid filename. Assets are stored under their key and file extension, so neither " +
+        "may contain a path separator. Check the server that produced this manifest."
     }
   }
 }
@@ -157,12 +162,21 @@ public class Update: NSObject {
     }
     switch protocolVersion {
     case 0, 1:
-      return ExpoUpdatesUpdate.update(
+      let update = ExpoUpdatesUpdate.update(
         withExpoUpdatesManifest: ExpoUpdatesManifest(rawManifestJSON: withManifest),
         extensions: extensions,
         config: config,
         database: database
       )
+      try update.assets()?.forEach { asset in
+        guard UpdatesUtils.isSafeFilename(asset.filename) else {
+          throw UpdateError.unsafeAssetFilename(
+            updateId: update.updateId.uuidString,
+            filename: asset.filename
+          )
+        }
+      }
+      return update
     default:
       throw UpdateError.invalidExpoProtocolVersion(protocolVersion: protocolVersion)
     }

package/ios/EXUpdates/UpdatesError.swift

@@ -26,6 +26,7 @@ public enum UpdatesError: Error, Sendable, LocalizedError {
   case fileDownloaderFailedUpdateIDsFailure(cause: Error)
   case fileDownloaderUnknownError(cause: Error)
   case remoteAppLoaderAssetMissingUrl
+  case remoteAppLoaderUnsafeAssetFilename(filename: String)
   case remoteAppLoaderHeaderDataError(cause: Error)
   case remoteAppLoaderUnknownError(cause: Error)
   case appLoaderFailedToLoadAllAssets
@@ -92,6 +93,8 @@ public enum UpdatesError: Error, Sendable, LocalizedError {
       return "Unknown error: \(cause.localizedDescription)"
     case .remoteAppLoaderAssetMissingUrl:
       return "Failed to download asset with no URL provided"
+    case let .remoteAppLoaderUnsafeAssetFilename(filename):
+      return "Failed to download asset: filename \"\(filename)\" would resolve outside the updates directory"
     case let .remoteAppLoaderHeaderDataError(cause):
       return "Error persisting header data to disk: \(cause.localizedDescription)"
     case .appLoaderFailedToLoadAllAssets:

package/ios/EXUpdates/UpdatesUtils.swift

@@ -75,6 +75,23 @@ public final class UpdatesUtils: NSObject {
     return updatesDirectory
   }
 
+  /**
+   * Asset filenames are built from manifest-controlled values, so a filename holding a path
+   * separator or a `..` component would resolve outside the updates directory.
+   *
+   * Matching is done on unicode scalars because `String.contains` compares grapheme clusters, and
+   * a separator followed by a combining mark forms one cluster that does not equal the separator.
+   * The filesystem still sees the separator byte.
+   */
+  public static func isSafeFilename(_ filename: String) -> Bool {
+    return !filename.isEmpty &&
+      filename != "." &&
+      filename != ".." &&
+      !filename.unicodeScalars.contains("/") &&
+      !filename.unicodeScalars.contains("\\") &&
+      !filename.unicodeScalars.contains("\0")
+  }
+
   // MARK: - Internal methods
 
   public static func defaultNativeStateMachineContextJson() -> [String: Any?] {

package/ios/EXUpdates.podspec

@@ -141,6 +141,7 @@ Pod::Spec.new do |s|
     test_spec.dependency 'ExpoModulesTestCore'
 
     test_spec.pod_target_xcconfig = {
+      'OTHER_LDFLAGS' => '$(inherited) -lc++',
       'USER_HEADER_SEARCH_PATHS' => '"${CONFIGURATION_TEMP_DIR}/EXUpdates.build/DerivedSources"',
       'GCC_TREAT_INCOMPATIBLE_POINTER_TYPE_WARNINGS_AS_ERRORS' => 'YES',
       'GCC_TREAT_IMPLICIT_FUNCTION_DECLARATIONS_AS_ERRORS' => 'YES',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-updates",
-  "version": "57.0.12",
+  "version": "57.0.14",
   "description": "Fetches and manages remotely-hosted assets and updates to your app's JS bundle.",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -60,10 +60,10 @@
     "picomatch": "^4.0.4",
     "ts-node": "^10.9.2",
     "xstate": "^4.37.2",
-    "@expo/metro-config": "57.0.7",
-    "expo": "57.0.10",
-    "expo-module-scripts": "56.0.3",
-    "expo-dev-client": "57.0.10"
+    "@expo/metro-config": "57.0.8",
+    "expo-dev-client": "57.0.12",
+    "expo": "57.0.13",
+    "expo-module-scripts": "56.0.3"
   },
   "peerDependencies": {
     "expo": "*",
@@ -82,7 +82,7 @@
       "./scripts/with-node.sh"
     ]
   },
-  "gitHead": "fb5049481ebd5cadd499c4d1f1d5e47f9ac678be",
+  "gitHead": "125b8d4472432db3dc4ae047730432d7bd5bd30c",
   "scripts": {
     "build": "expo-module build",
     "clean": "expo-module clean",