expo-updates 57.0.13 → 57.0.15

package/CHANGELOG.md

@@ -10,6 +10,20 @@
 
 ### 💡 Others
 
+## 57.0.15 — 2026-08-17
+
+_This version does not introduce any user-facing changes._
+
+## 57.0.14 — 2026-08-14
+
+### 🐛 Bug fixes
+
+- Reject updates whose asset key or file extension contains a path separator, which previously let a manifest write and delete files outside the updates directory. ([#48762](https://github.com/expo/expo/pull/48762), [#48763](https://github.com/expo/expo/pull/48763) by [@alanjhughes](https://github.com/alanjhughes))
+
+### 💡 Others
+
+- [iOS] Link `libc++` in the test spec so the unit test bundle resolves the C++ symbols it pulls from `ExpoModulesCore`. ([#48762](https://github.com/expo/expo/pull/48762) by [@alanjhughes](https://github.com/alanjhughes))
+
 ## 57.0.13 — 2026-08-10
 
 _This version does not introduce any user-facing changes._

package/android/build.gradle

@@ -42,7 +42,7 @@ expoModule {
 }
 
 group = 'host.exp.exponent'
-version = '57.0.13'
+version = '57.0.15'
 
 // Utility method to derive boolean values from the environment or from Java properties,
 // and return them as strings to be used in BuildConfig fields
@@ -89,7 +89,7 @@ android {
   namespace "expo.modules.updates"
   defaultConfig {
     versionCode 31
-    versionName '57.0.13'
+    versionName '57.0.15'
     consumerProguardFiles("proguard-rules.pro")
     testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
 

package/android/src/main/java/expo/modules/updates/UpdatesUtils.kt

@@ -166,6 +166,17 @@ object UpdatesUtils {
     }
   }
 
+  /**
+   * Asset filenames are built from manifest-controlled values, so a filename holding a path
+   * separator or a `..` component would resolve outside the updates directory.
+   */
+  fun isSafeFilename(filename: String): Boolean {
+    return filename.isNotEmpty() &&
+      filename != "." &&
+      filename != ".." &&
+      filename.none { it == '/' || it == '\\' || it == '\u0000' }
+  }
+
   fun shouldCheckForUpdateOnLaunch(
     updatesConfiguration: UpdatesConfiguration,
     logger: UpdatesLogger,

package/android/src/main/java/expo/modules/updates/db/Reaper.kt

@@ -2,10 +2,12 @@ package expo.modules.updates.db
 
 import android.util.Log
 import expo.modules.updates.UpdatesConfiguration
+import expo.modules.updates.UpdatesUtils
 import expo.modules.updates.db.entity.AssetEntity
 import expo.modules.updates.db.entity.UpdateEntity
 import expo.modules.updates.manifest.ManifestMetadata
 import expo.modules.updates.selectionpolicy.SelectionPolicy
+import expo.modules.updates.utils.AndroidResourceAssetUtils
 import java.io.File
 
 /**
@@ -47,7 +49,20 @@ object Reaper {
         )
         continue
       }
-      val path = File(updatesDirectory, asset.relativePath)
+      val relativePath = asset.relativePath
+      // Embedded assets are served from the APK, so there is no file here to delete.
+      if (relativePath == null || AndroidResourceAssetUtils.isAndroidResourceAsset(relativePath)) {
+        continue
+      }
+      // A row written before asset filenames were validated may point outside the updates directory.
+      if (!UpdatesUtils.isSafeFilename(relativePath)) {
+        Log.e(
+          TAG,
+          "Refusing to delete asset with URL " + asset.url + " at unsafe path " + relativePath
+        )
+        continue
+      }
+      val path = File(updatesDirectory, relativePath)
       try {
         if (path.exists() && !path.delete()) {
           Log.e(TAG, "Failed to delete asset with URL " + asset.url + " at path " + path.toString())

package/android/src/main/java/expo/modules/updates/loader/FileDownloader.kt

@@ -687,6 +687,12 @@ class FileDownloader(
     }
 
     val filename = UpdatesUtils.createFilenameForAsset(asset)
+    if (!UpdatesUtils.isSafeFilename(filename)) {
+      val message = "Failed to download asset ${asset.key}"
+      val error = IOException("Asset filename \"$filename\" would resolve outside the updates directory")
+      logger.error(message, error, UpdatesErrorCode.AssetsFailedToLoad)
+      throw IOException(message, error)
+    }
     val path = File(destinationDirectory, filename)
 
     if (path.exists()) {

package/android/src/main/java/expo/modules/updates/manifest/ExpoUpdatesUpdate.kt

@@ -14,6 +14,7 @@ import expo.modules.updates.db.enums.UpdateStatus
 import org.json.JSONArray
 import org.json.JSONException
 import org.json.JSONObject
+import java.io.IOException
 import java.text.ParseException
 import java.util.*
 
@@ -95,27 +96,43 @@ class ExpoUpdatesUpdate private constructor(
   companion object {
     private val TAG = Update::class.java.simpleName
 
-    @Throws(JSONException::class)
+    @Throws(Exception::class)
     fun fromExpoUpdatesManifest(
       manifest: ExpoUpdatesManifest,
       extensions: JSONObject?,
       configuration: UpdatesConfiguration
-    ): ExpoUpdatesUpdate = ExpoUpdatesUpdate(
-      manifest,
-      id = UUID.fromString(manifest.getID()),
-      configuration.scopeKey,
-      commitTime = try {
-        UpdatesUtils.parseDateString(manifest.getCreatedAt())
-      } catch (e: ParseException) {
-        Log.e(TAG, "Could not parse manifest createdAt string; falling back to current time", e)
-        Date()
-      },
-      runtimeVersion = manifest.getRuntimeVersion(),
-      launchAsset = manifest.getLaunchAsset(),
-      assets = manifest.getAssets(),
-      extensions = extensions,
-      url = configuration.updateUrl,
-      requestHeaders = configuration.requestHeaders
-    )
+    ): ExpoUpdatesUpdate {
+      val update = ExpoUpdatesUpdate(
+        manifest,
+        id = UUID.fromString(manifest.getID()),
+        configuration.scopeKey,
+        commitTime = try {
+          UpdatesUtils.parseDateString(manifest.getCreatedAt())
+        } catch (e: ParseException) {
+          Log.e(TAG, "Could not parse manifest createdAt string; falling back to current time", e)
+          Date()
+        },
+        runtimeVersion = manifest.getRuntimeVersion(),
+        launchAsset = manifest.getLaunchAsset(),
+        assets = manifest.getAssets(),
+        extensions = extensions,
+        url = configuration.updateUrl,
+        requestHeaders = configuration.requestHeaders
+      )
+
+      update.assetEntityList.forEach { asset ->
+        val filename = UpdatesUtils.createFilenameForAsset(asset)
+        if (!UpdatesUtils.isSafeFilename(filename)) {
+          throw IOException(
+            "Update ${manifest.getID()} could not be loaded because the asset filename " +
+              "\"$filename\" is not a valid filename. Assets are stored under their key and file " +
+              "extension, so neither may contain a path separator. Check the server that produced " +
+              "this manifest."
+          )
+        }
+      }
+
+      return update
+    }
   }
 }

package/ios/EXUpdates/AppLauncher/AppLauncherWithDatabase.swift

@@ -32,6 +32,11 @@ public class AppLauncherWithDatabase: NSObject, AppLauncher {
   public var launchAssetUrl: URL?
   public var assetFilesMap: [String: String]?
 
+  /// Set when the launched update is served directly from the embedded app binary. Tracked
+  /// explicitly because `assetFilesMap` is now populated with the bundle-resolved embedded assets,
+  /// so it can no longer double as the "using embedded assets" signal.
+  private var launchedFromEmbeddedBundle = false
+
   private let launcherQueue: DispatchQueue
   private var completedAssets: Int
   private let config: UpdatesConfig
@@ -54,7 +59,7 @@ public class AppLauncherWithDatabase: NSObject, AppLauncher {
   }
 
   public func isUsingEmbeddedAssets() -> Bool {
-    return assetFilesMap == nil
+    return launchedFromEmbeddedBundle
   }
 
   public static func launchableUpdate(
@@ -178,7 +183,10 @@ public class AppLauncherWithDatabase: NSObject, AppLauncher {
     }
 
     if launchedUpdate.status == UpdateStatus.StatusEmbedded {
-      precondition(assetFilesMap == nil, "assetFilesMap should be null for embedded updates")
+      launchedFromEmbeddedBundle = true
+      // The embedded update's assets aren't copied into the cache, so resolve them from the app
+      // binary. Populating the map here keeps `Updates.localAssets` available instead of empty.
+      assetFilesMap = UpdatesUtils.embeddedAssetsMap(withConfig: config, database: database, logger: logger)
       launchAssetUrl = updatesBundle.url(
         forResource: EmbeddedAppLoader.EXUpdatesBareEmbeddedBundleFilename,
         withExtension: EmbeddedAppLoader.EXUpdatesBareEmbeddedBundleFileType

package/ios/EXUpdates/AppLoader/EmbeddedAppLoader.swift

@@ -8,14 +8,12 @@
 import Foundation
 
 /**
- * Subclass of AppLoader which handles copying the embedded update's assets into the
- * expo-updates cache location.
+ * Subclass of AppLoader which loads the embedded update.
  *
- * Rather than launching the embedded update directly from its location in the app bundle/apk, we
- * first try to read it into the expo-updates cache and database and launch it like any other
- * update. The benefits of this include (a) a single code path for launching most updates and (b)
- * assets included in embedded updates and copied into the cache in this way do not need to be
- * redownloaded if included in future updates.
+ * By default (`EX_UPDATES_COPY_EMBEDDED_ASSETS` off) the update is registered but its assets aren't
+ * read into the database; it keeps StatusEmbedded and launches from the app binary, so first launch
+ * stays fast. When the flag is on, assets are read into the database and it launches like any other
+ * update, so a later update reusing them avoids a redownload.
  */
 @objc(EXUpdatesEmbeddedAppLoader)
 @objcMembers
@@ -29,6 +27,24 @@ public final class EmbeddedAppLoader: AppLoader {
 
   private static var embeddedManifestInternal: EmbeddedUpdate?
 
+  /// Whether to read and hash embedded assets into the database on first launch. Defaults to the
+  /// build-time `EX_UPDATES_COPY_EMBEDDED_ASSETS` flag (off). Overridable for testing.
+  internal var shouldCopyEmbeddedAssets: Bool = UpdatesUtils.shouldCopyEmbeddedAssets()
+
+  internal let completionQueue: DispatchQueue
+
+  public required override init(
+    config: UpdatesConfig,
+    logger: UpdatesLogger,
+    database: UpdatesDatabase,
+    directory: URL,
+    launchedUpdate: Update?,
+    completionQueue: DispatchQueue
+  ) {
+    self.completionQueue = completionQueue
+    super.init(config: config, logger: logger, database: database, directory: directory, launchedUpdate: launchedUpdate, completionQueue: completionQueue)
+  }
+
   /**
    Gets the embedded update.
    If the `UpdatesConfig.hasEmbeddedUpdate` is false, it returns nil
@@ -136,6 +152,18 @@ public final class EmbeddedAppLoader: AppLoader {
     self.assetBlock = assetBlock
     self.successBlock = successBlock
     self.errorBlock = errorBlock
+    startEmbeddedLoad(fromEmbeddedManifest: embeddedManifest)
+  }
+
+  /// Loads the embedded update: with copying off (default) registers it without ingesting assets,
+  /// otherwise loads them like any other update. Separate from `loadUpdateResponseFromEmbeddedManifest`
+  /// so tests can pass a manifest without reading the bundle.
+  internal func startEmbeddedLoad(fromEmbeddedManifest embeddedManifest: Update) {
+    if !shouldCopyEmbeddedAssets {
+      registerEmbeddedUpdateWithoutCopying(embeddedManifest)
+      return
+    }
+
     startLoading(fromUpdateResponse: UpdateResponse(
       responseHeaderData: nil,
       manifestUpdateResponsePart: ManifestUpdateResponsePart(updateManifest: embeddedManifest),
@@ -143,6 +171,40 @@ public final class EmbeddedAppLoader: AppLoader {
     ))
   }
 
+  /// Registers the embedded update without reading, hashing, or copying its assets. A StatusEmbedded
+  /// update resolves its bundle and assets from the app binary at launch. Tradeoff: a future update
+  /// reusing an embedded asset re-downloads it.
+  private func registerEmbeddedUpdateWithoutCopying(_ embeddedManifest: Update) {
+    database.databaseQueue.async {
+      do {
+        let existingUpdate = try? self.database.update(withId: embeddedManifest.updateId, config: self.config)
+        if existingUpdate == nil {
+          try self.database.addUpdate(embeddedManifest, config: self.config)
+        }
+        // Mark finished (keep = 1) so the reaper retains it; it stays StatusEmbedded since copying is off.
+        try self.database.markUpdateFinished(embeddedManifest)
+      } catch {
+        let errorBlock = self.errorBlock
+        self.completionQueue.async {
+          errorBlock?(UpdatesError.appLoaderUnknownError(cause: error))
+          self.reset()
+        }
+        return
+      }
+
+      let successBlock = self.successBlock
+      let updateResponse = UpdateResponse(
+        responseHeaderData: nil,
+        manifestUpdateResponsePart: ManifestUpdateResponsePart(updateManifest: embeddedManifest),
+        directiveUpdateResponsePart: nil
+      )
+      self.completionQueue.async {
+        successBlock?(updateResponse)
+        self.reset()
+      }
+    }
+  }
+
   override public func downloadAsset(_ asset: UpdateAsset, extraHeaders: [String: Any]) {
     FileDownloader.assetFilesQueue.async {
       self.handleAssetDownloadAlreadyExists(asset)

package/ios/EXUpdates/AppLoader/RemoteAppLoader.swift

@@ -105,6 +105,13 @@ public final class RemoteAppLoader: AppLoader {
   }
 
   override public func downloadAsset(_ asset: UpdateAsset, extraHeaders: [String: Any]) {
+    guard UpdatesUtils.isSafeFilename(asset.filename) else {
+      self.handleAssetDownload(
+        withError: UpdatesError.remoteAppLoaderUnsafeAssetFilename(filename: asset.filename),
+        asset: asset
+      )
+      return
+    }
     let urlOnDisk = self.directory.appendingPathComponent(asset.filename)
 
     let progressBlock = { [weak self] fractionCompleted in

package/ios/EXUpdates/Database/UpdatesDatabase.swift

@@ -280,7 +280,11 @@ public final class UpdatesDatabase: NSObject {
   }
 
   public func markUpdateFinished(_ update: Update) throws {
-    if update.status != UpdateStatus.StatusDevelopment {
+    // With copying off, embedded updates have no asset rows, so they must stay StatusEmbedded to keep
+    // launching from the bundle. Promoting to StatusReady would route launch through the database
+    // asset path, which has no rows for them.
+    let keepEmbedded = update.status == UpdateStatus.StatusEmbedded && !UpdatesUtils.shouldCopyEmbeddedAssets()
+    if update.status != UpdateStatus.StatusDevelopment && !keepEmbedded {
       update.status = UpdateStatus.StatusReady
     }
 

package/ios/EXUpdates/Database/UpdatesReaper.swift

@@ -71,6 +71,10 @@ public final class UpdatesReaper: NSObject {
 
         let beginDeleteAssets = Date()
         for asset in assetsForDeletion {
+          guard UpdatesUtils.isSafeFilename(asset.filename) else {
+            logger.warn(message: "Refusing to delete asset at unsafe path \(asset.filename)")
+            continue
+          }
           let localUrl = directory.appendingPathComponent(asset.filename)
           if FileManager.default.fileExists(atPath: localUrl.path) {
             do {

package/ios/EXUpdates/Update/Update.swift

@@ -77,6 +77,7 @@ public enum UpdateStatus: Int {
 public enum UpdateError: Error, Sendable, LocalizedError {
   case invalidExpoProtocolVersion(protocolVersion: Int)
   case legacyManifestInstantiationInvalid
+  case unsafeAssetFilename(updateId: String, filename: String)
 
   public var errorDescription: String? {
     switch self {
@@ -84,6 +85,10 @@ public enum UpdateError: Error, Sendable, LocalizedError {
       return "Invalid Expo Updates protocol version: \(protocolVersion)"
     case .legacyManifestInstantiationInvalid:
       return "This version of expo-updates can no longer load legacy manifests"
+    case let .unsafeAssetFilename(updateId, filename):
+      return "Update \(updateId) could not be loaded because the asset filename \"\(filename)\" " +
+        "is not a valid filename. Assets are stored under their key and file extension, so neither " +
+        "may contain a path separator. Check the server that produced this manifest."
     }
   }
 }
@@ -157,12 +162,21 @@ public class Update: NSObject {
     }
     switch protocolVersion {
     case 0, 1:
-      return ExpoUpdatesUpdate.update(
+      let update = ExpoUpdatesUpdate.update(
         withExpoUpdatesManifest: ExpoUpdatesManifest(rawManifestJSON: withManifest),
         extensions: extensions,
         config: config,
         database: database
       )
+      try update.assets()?.forEach { asset in
+        guard UpdatesUtils.isSafeFilename(asset.filename) else {
+          throw UpdateError.unsafeAssetFilename(
+            updateId: update.updateId.uuidString,
+            filename: asset.filename
+          )
+        }
+      }
+      return update
     default:
       throw UpdateError.invalidExpoProtocolVersion(protocolVersion: protocolVersion)
     }

package/ios/EXUpdates/UpdatesError.swift

@@ -26,6 +26,7 @@ public enum UpdatesError: Error, Sendable, LocalizedError {
   case fileDownloaderFailedUpdateIDsFailure(cause: Error)
   case fileDownloaderUnknownError(cause: Error)
   case remoteAppLoaderAssetMissingUrl
+  case remoteAppLoaderUnsafeAssetFilename(filename: String)
   case remoteAppLoaderHeaderDataError(cause: Error)
   case remoteAppLoaderUnknownError(cause: Error)
   case appLoaderFailedToLoadAllAssets
@@ -92,6 +93,8 @@ public enum UpdatesError: Error, Sendable, LocalizedError {
       return "Unknown error: \(cause.localizedDescription)"
     case .remoteAppLoaderAssetMissingUrl:
       return "Failed to download asset with no URL provided"
+    case let .remoteAppLoaderUnsafeAssetFilename(filename):
+      return "Failed to download asset: filename \"\(filename)\" would resolve outside the updates directory"
     case let .remoteAppLoaderHeaderDataError(cause):
       return "Error persisting header data to disk: \(cause.localizedDescription)"
     case .appLoaderFailedToLoadAllAssets:

package/ios/EXUpdates/UpdatesUtils.swift

@@ -75,6 +75,23 @@ public final class UpdatesUtils: NSObject {
     return updatesDirectory
   }
 
+  /**
+   * Asset filenames are built from manifest-controlled values, so a filename holding a path
+   * separator or a `..` component would resolve outside the updates directory.
+   *
+   * Matching is done on unicode scalars because `String.contains` compares grapheme clusters, and
+   * a separator followed by a combining mark forms one cluster that does not equal the separator.
+   * The filesystem still sees the separator byte.
+   */
+  public static func isSafeFilename(_ filename: String) -> Bool {
+    return !filename.isEmpty &&
+      filename != "." &&
+      filename != ".." &&
+      !filename.unicodeScalars.contains("/") &&
+      !filename.unicodeScalars.contains("\\") &&
+      !filename.unicodeScalars.contains("\0")
+  }
+
   // MARK: - Internal methods
 
   public static func defaultNativeStateMachineContextJson() -> [String: Any?] {
@@ -165,6 +182,14 @@ public final class UpdatesUtils: NSObject {
 #endif
   }
 
+  internal static func shouldCopyEmbeddedAssets() -> Bool {
+#if EX_UPDATES_COPY_EMBEDDED_ASSETS
+    return true
+#else
+    return false
+#endif
+  }
+
   internal static func runBlockOnMainThread(_ block: @escaping () -> Void) {
     if Thread.isMainThread {
       block()

package/ios/EXUpdates.podspec

@@ -9,6 +9,9 @@ end
 if ENV['EX_UPDATES_CUSTOM_INIT'] != '1'
   ENV['EX_UPDATES_CUSTOM_INIT'] = podfile_properties['updatesCustomInit'] == 'true' ? '1' : '0'
 end
+if ENV['EX_UPDATES_COPY_EMBEDDED_ASSETS'] != '1'
+  ENV['EX_UPDATES_COPY_EMBEDDED_ASSETS'] = podfile_properties['updatesCopyEmbeddedAssets'] == 'true' ? '1' : '0'
+end
 
 use_dev_client = false
 begin
@@ -72,6 +75,7 @@ Pod::Spec.new do |s|
 
   ex_updates_native_debug = ENV['EX_UPDATES_NATIVE_DEBUG'] == '1'
   ex_updates_custom_init = ENV['EX_UPDATES_CUSTOM_INIT'] == '1'
+  ex_updates_copy_embedded_assets = ENV['EX_UPDATES_COPY_EMBEDDED_ASSETS'] == '1'
   if ex_updates_native_debug
     other_debug_c_flags << ' -DEX_UPDATES_NATIVE_DEBUG=1'
     other_debug_swift_flags << ' -DEX_UPDATES_NATIVE_DEBUG'
@@ -82,6 +86,12 @@ Pod::Spec.new do |s|
     other_release_c_flags << ' -DEX_UPDATES_CUSTOM_INIT=1'
     other_release_swift_flags << ' -DEX_UPDATES_CUSTOM_INIT'
   end
+  if ex_updates_copy_embedded_assets
+    other_debug_c_flags << ' -DEX_UPDATES_COPY_EMBEDDED_ASSETS=1'
+    other_debug_swift_flags << ' -DEX_UPDATES_COPY_EMBEDDED_ASSETS'
+    other_release_c_flags << ' -DEX_UPDATES_COPY_EMBEDDED_ASSETS=1'
+    other_release_swift_flags << ' -DEX_UPDATES_COPY_EMBEDDED_ASSETS'
+  end
   if use_dev_client
     other_debug_c_flags << ' -DUSE_DEV_CLIENT=1'
     other_debug_swift_flags << ' -DUSE_DEV_CLIENT'
@@ -141,6 +151,7 @@ Pod::Spec.new do |s|
     test_spec.dependency 'ExpoModulesTestCore'
 
     test_spec.pod_target_xcconfig = {
+      'OTHER_LDFLAGS' => '$(inherited) -lc++',
       'USER_HEADER_SEARCH_PATHS' => '"${CONFIGURATION_TEMP_DIR}/EXUpdates.build/DerivedSources"',
       'GCC_TREAT_INCOMPATIBLE_POINTER_TYPE_WARNINGS_AS_ERRORS' => 'YES',
       'GCC_TREAT_IMPLICIT_FUNCTION_DECLARATIONS_AS_ERRORS' => 'YES',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-updates",
-  "version": "57.0.13",
+  "version": "57.0.15",
   "description": "Fetches and manages remotely-hosted assets and updates to your app's JS bundle.",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -60,10 +60,10 @@
     "picomatch": "^4.0.4",
     "ts-node": "^10.9.2",
     "xstate": "^4.37.2",
-    "expo": "57.0.12",
-    "expo-dev-client": "57.0.11",
-    "expo-module-scripts": "56.0.3",
-    "@expo/metro-config": "57.0.8"
+    "expo": "57.0.14",
+    "@expo/metro-config": "57.0.8",
+    "expo-dev-client": "57.0.13",
+    "expo-module-scripts": "56.0.3"
   },
   "peerDependencies": {
     "expo": "*",
@@ -82,7 +82,7 @@
       "./scripts/with-node.sh"
     ]
   },
-  "gitHead": "9a08ef16f8abc1788dec0014612be5eeb5dc03af",
+  "gitHead": "391d762fa5059cebf63ef2381da93994ce97fc63",
   "scripts": {
     "build": "expo-module build",
     "clean": "expo-module clean",