expo-updates 58.0.0 → 58.0.2

package/.npmignore

@@ -17,3 +17,8 @@ __rsc_tests__
 /android/src/androidTest/
 /android/src/test/
 /ios/Tests
+
+# Exclude native build output (pnpm pack ignores nested .gitignore files)
+.cxx/
+.gradle/
+/android/build/

package/CHANGELOG.md

@@ -10,6 +10,17 @@
 
 ### 💡 Others
 
+## 58.0.2 — 2026-09-14
+
+_This version does not introduce any user-facing changes._
+
+## 58.0.1 — 2026-09-14
+
+### 🐛 Bug fixes
+
+- [iOS] Apply bundle diffs against the embedded bundle in the app binary when the launched update is the embedded one, instead of failing to resolve a patch base and downloading the full bundle. ([#50018](https://github.com/expo/expo/pull/50018) by [@alanjhughes](https://github.com/alanjhughes))
+- [Android] Apply bundle diffs against the embedded bundle in the app binary when the launched update is the embedded one, instead of failing to resolve a patch base and downloading the full bundle. ([#50019](https://github.com/expo/expo/pull/50019) by [@alanjhughes](https://github.com/alanjhughes))
+
 ## 58.0.0 — 2026-09-10
 
 ### 🎉 New features

package/android/build.gradle

@@ -42,7 +42,7 @@ expoModule {
 }
 
 group = 'host.exp.exponent'
-version = '58.0.0'
+version = '58.0.2'
 
 // Utility method to derive boolean values from the environment or from Java properties,
 // and return them as strings to be used in BuildConfig fields
@@ -98,7 +98,7 @@ android {
   namespace "expo.modules.updates"
   defaultConfig {
     versionCode 31
-    versionName '58.0.0'
+    versionName '58.0.2'
     consumerProguardFiles("proguard-rules.pro")
     testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
 

package/android/src/main/java/expo/modules/updates/loader/FileDownloader.kt

@@ -23,6 +23,7 @@ import expo.modules.updates.manifest.ResponsePartHeaderData
 import expo.modules.updates.manifest.ResponsePartInfo
 import expo.modules.updates.manifest.UpdateFactory
 import expo.modules.updates.selectionpolicy.SelectionPolicies
+import expo.modules.updates.utils.AndroidResourceAssetUtils
 import kotlinx.coroutines.suspendCancellableCoroutine
 import okhttp3.Cache
 import okhttp3.Headers
@@ -51,6 +52,7 @@ import kotlin.math.min
 
 private const val PATCH_TEMP_SUFFIX = ".patch"
 private const val PATCHED_TEMP_SUFFIX = ".patched"
+private const val PATCH_BASE_TEMP_SUFFIX = ".base"
 private const val A_IM_HEADER = "A-IM"
 private const val IM_HEADER = "im"
 private const val EXPO_BASE_UPDATE_ID_RESPONSE_HEADER = "expo-base-update-id"
@@ -58,6 +60,8 @@ private const val EXPO_CURRENT_UPDATE_ID_HEADER = "Expo-Current-Update-ID"
 private const val EXPO_REQUESTED_UPDATE_ID_HEADER = "Expo-Requested-Update-ID"
 private const val EXPO_EMBEDDED_UPDATE_ID_HEADER = "Expo-Embedded-Update-ID"
 
+internal typealias EmbeddedAssetExtractor = (AssetEntity, File) -> Unit
+
 /**
  * Utility class that holds all the logic for downloading data and files, such as update manifests
  * and assets, using an instance of [OkHttpClient].
@@ -107,7 +111,8 @@ class FileDownloader(
     progressListener: FileDownloadProgressListener? = null,
     allowPatch: Boolean,
     launchedUpdate: UpdateEntity? = null,
-    requestedUpdate: UpdateEntity? = null
+    requestedUpdate: UpdateEntity? = null,
+    embeddedAssetExtractor: EmbeddedAssetExtractor? = null
   ): FileDownloadResult {
     try {
       val response = downloadData(request, progressListener)
@@ -176,7 +181,8 @@ class FileDownloader(
                 updatesDirectory = updatesDirectory,
                 launchedUpdate = launchedUpdate,
                 requestedUpdate = requestedUpdate,
-                expectedBase64URLEncodedSHA256Hash = expectedBase64URLEncodedSHA256Hash
+                expectedBase64URLEncodedSHA256Hash = expectedBase64URLEncodedSHA256Hash,
+                embeddedAssetExtractor = embeddedAssetExtractor
               )
             }.getOrElse {
               logger.warn(
@@ -294,36 +300,47 @@ class FileDownloader(
     updatesDirectory: File,
     launchedUpdate: UpdateEntity,
     requestedUpdate: UpdateEntity?,
-    expectedBase64URLEncodedSHA256Hash: String?
+    expectedBase64URLEncodedSHA256Hash: String?,
+    embeddedAssetExtractor: EmbeddedAssetExtractor? = null
   ): ByteArray {
     val launchAssetContext = prepareAssetForDiff(
       asset = asset,
       responseBody = responseBody,
+      destination = destination,
       updatesDirectory = updatesDirectory,
-      launchedUpdate = launchedUpdate
+      launchedUpdate = launchedUpdate,
+      embeddedAssetExtractor = embeddedAssetExtractor
     )
 
-    return applyHermesDiff(
-      baseFile = launchAssetContext.baseFile,
-      diffBody = responseBody,
-      destination = destination,
-      expectedBase64URLEncodedSHA256Hash = expectedBase64URLEncodedSHA256Hash,
-      asset = asset,
-      requestedUpdateId = requestedUpdate?.id?.toString()
-    )
+    try {
+      return applyHermesDiff(
+        baseFile = launchAssetContext.baseFile,
+        diffBody = responseBody,
+        destination = destination,
+        expectedBase64URLEncodedSHA256Hash = expectedBase64URLEncodedSHA256Hash,
+        asset = asset,
+        requestedUpdateId = requestedUpdate?.id?.toString()
+      )
+    } finally {
+      if (launchAssetContext.isTemporary) {
+        launchAssetContext.baseFile.delete()
+      }
+    }
   }
 
-  internal data class LaunchAssetContext(val baseFile: File)
+  internal data class LaunchAssetContext(val baseFile: File, val isTemporary: Boolean = false)
 
   @VisibleForTesting
   internal fun prepareAssetForDiff(
     asset: AssetEntity,
     responseBody: ResponseBody,
+    destination: File,
     updatesDirectory: File,
-    launchedUpdate: UpdateEntity
+    launchedUpdate: UpdateEntity,
+    embeddedAssetExtractor: EmbeddedAssetExtractor? = null
   ): LaunchAssetContext {
     return try {
-      preparePatchBaseAsset(asset, updatesDirectory, launchedUpdate)
+      preparePatchBaseAsset(asset, destination, updatesDirectory, launchedUpdate, embeddedAssetExtractor)
     } catch (e: Exception) {
       responseBody.close()
       if (e is IOException) {
@@ -336,8 +353,10 @@ class FileDownloader(
 
   private fun preparePatchBaseAsset(
     asset: AssetEntity,
+    destination: File,
     updatesDirectory: File,
-    launchedUpdate: UpdateEntity
+    launchedUpdate: UpdateEntity,
+    embeddedAssetExtractor: EmbeddedAssetExtractor? = null
   ): LaunchAssetContext {
     if (!asset.isLaunchAsset) {
       throw IOException("Received patch for non-launch asset ${asset.key}")
@@ -351,29 +370,60 @@ class FileDownloader(
     val launchAssetRelativePath = launchAssetEntity.relativePath
       ?: throw IOException("Launch asset for update $currentUpdateId is missing a relative path")
 
-    val baseFile = File(updatesDirectory, launchAssetRelativePath)
+    // BSPatch needs a real path, so an asset inside the APK is extracted first.
+    val isEmbeddedLaunchAsset = AndroidResourceAssetUtils.isAndroidResourceAsset(launchAssetRelativePath)
+    val baseFile = if (isEmbeddedLaunchAsset) {
+      extractEmbeddedPatchBaseAsset(launchAssetEntity, destination, embeddedAssetExtractor)
+    } else {
+      File(updatesDirectory, launchAssetRelativePath)
+    }
     if (!baseFile.exists()) {
       throw IOException("Base asset $baseFile is missing; cannot apply patch")
     }
 
-    val actualBaseHash = try {
-      UpdatesUtils.toBase64Url(UpdatesUtils.sha256(baseFile))
-    } catch (_: Exception) {
-      null
+    val expectedBaseHash = launchAssetEntity.expectedHash
+    if (expectedBaseHash != null) {
+      val actualBaseHash = try {
+        UpdatesUtils.toBase64Url(UpdatesUtils.sha256(baseFile))
+      } catch (_: Exception) {
+        null
+      }
+      if (actualBaseHash != null && expectedBaseHash != actualBaseHash) {
+        logger.warn(
+          "Asset hash mismatch for update $currentUpdateId; expected=$expectedBaseHash actual=$actualBaseHash",
+          UpdatesErrorCode.AssetsFailedToLoad,
+          currentUpdateId.toString(),
+          asset.key
+        )
+        if (isEmbeddedLaunchAsset) {
+          baseFile.delete()
+        }
+        throw IOException("Asset hash mismatch for update $currentUpdateId; expected=$expectedBaseHash actual=$actualBaseHash")
+      }
     }
 
-    val expectedBaseHash = launchAssetEntity.expectedHash
-    if (expectedBaseHash != null && actualBaseHash != null && expectedBaseHash != actualBaseHash) {
-      logger.warn(
-        "Asset hash mismatch for update $currentUpdateId; expected=$expectedBaseHash actual=$actualBaseHash",
-        UpdatesErrorCode.AssetsFailedToLoad,
-        currentUpdateId.toString(),
-        asset.key
-      )
-      throw IOException("Asset hash mismatch for update $currentUpdateId; expected=$expectedBaseHash actual=$actualBaseHash")
+    return LaunchAssetContext(baseFile, isTemporary = isEmbeddedLaunchAsset)
+  }
+
+  @Throws(IOException::class)
+  private fun extractEmbeddedPatchBaseAsset(
+    launchAssetEntity: AssetEntity,
+    destination: File,
+    embeddedAssetExtractor: EmbeddedAssetExtractor?
+  ): File {
+    if (embeddedAssetExtractor == null) {
+      throw IOException("The launch asset lives in the app binary and cannot be extracted without an extractor")
     }
 
-    return LaunchAssetContext(baseFile)
+    val baseFile = File(destination.absolutePath + PATCH_BASE_TEMP_SUFFIX)
+    try {
+      baseFile.parentFile?.mkdirs()
+      embeddedAssetExtractor(launchAssetEntity, baseFile)
+    } catch (e: Exception) {
+      baseFile.delete()
+      throw e as? IOException ?: IOException("Failed to extract the embedded launch asset", e)
+    }
+    return baseFile
   }
 
   @VisibleForTesting
@@ -678,7 +728,8 @@ class FileDownloader(
     extraHeaders: JSONObject,
     launchedUpdate: UpdateEntity?,
     requestedUpdate: UpdateEntity?,
-    assetLoadProgressListener: ((Double) -> Unit)? = null
+    assetLoadProgressListener: ((Double) -> Unit)? = null,
+    embeddedAssetExtractor: EmbeddedAssetExtractor? = null
   ): AssetDownloadResult {
     if (asset.url == null) {
       val message = "Failed to download asset ${asset.key}"
@@ -722,7 +773,8 @@ class FileDownloader(
           assetLoadProgressListener?.let { listener -> { listener.invoke(it) } },
           allowPatch = canApplyPatch,
           launchedUpdate = launchedUpdate,
-          requestedUpdate = requestedUpdate
+          requestedUpdate = requestedUpdate,
+          embeddedAssetExtractor = embeddedAssetExtractor
         )
 
         asset.downloadTime = Date()

package/android/src/main/java/expo/modules/updates/loader/RemoteLoader.kt

@@ -14,6 +14,7 @@ import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
 import java.io.File
+import java.io.IOException
 
 data class ProcessSuccessLoaderResult(
   val availableUpdate: UpdateEntity?,
@@ -66,9 +67,28 @@ class RemoteLoader internal constructor(
     embeddedUpdate: UpdateEntity?
   ): FileDownloader.AssetDownloadResult {
     val extraHeaders = FileDownloader.getExtraHeadersForRemoteAssetRequest(launchedUpdate, embeddedUpdate, requestedUpdate)
-    return mFileDownloader.downloadAsset(assetEntity, updatesDirectory, extraHeaders, launchedUpdate, requestedUpdate) { progress ->
-      assetLoadProgressListener(assetEntity, progress)
-    }
+    return mFileDownloader.downloadAsset(
+      asset = assetEntity,
+      destinationDirectory = updatesDirectory,
+      extraHeaders = extraHeaders,
+      launchedUpdate = launchedUpdate,
+      requestedUpdate = requestedUpdate,
+      embeddedAssetExtractor = { launchAsset, destination ->
+        // The stored path is not the APK asset name; resolve it through the embedded manifest by key.
+        val embeddedLaunchAsset = loaderFiles.readEmbeddedUpdate(context, configuration)
+          ?.assetEntityList
+          ?.find { it.key == launchAsset.key }
+          ?: throw IOException("No embedded asset matches launch asset ${launchAsset.key}")
+        val assetName = embeddedLaunchAsset.embeddedAssetFilename
+          ?: throw IOException("Embedded launch asset ${launchAsset.key} has no APK asset filename")
+        context.assets.open(assetName).use { input ->
+          destination.outputStream().use { output -> input.copyTo(output) }
+        }
+      },
+      assetLoadProgressListener = { progress ->
+        assetLoadProgressListener(assetEntity, progress)
+      }
+    )
   }
 
   companion object {

package/build/ExpoUpdates.web.d.ts

@@ -31,5 +31,5 @@ declare class ExpoUpdatesModule extends NativeModule<UpdatesEvents> implements U
     clearLogEntriesAsync(): Promise<void>;
     fetchUpdateAsync(): Promise<UpdateFetchResultFailure>;
 }
-declare const _default: typeof ExpoUpdatesModule;
+declare const _default: ExpoUpdatesModule;
 export default _default;

package/ios/EXUpdates/AppLoader/FileDownloader.swift

@@ -84,6 +84,12 @@ public final class FileDownloader {
   private let updatesDirectory: URL
   private let database: UpdatesDatabase
 
+  /// Overridable for testing, where the fixture is not in `updatesBundle`.
+  internal var embeddedLaunchAssetUrl: URL? = updatesBundle.url(
+    forResource: EmbeddedAppLoader.EXUpdatesBareEmbeddedBundleFilename,
+    withExtension: EmbeddedAppLoader.EXUpdatesBareEmbeddedBundleFileType
+  )
+
   public convenience init(
     config: UpdatesConfig,
     logger: UpdatesLogger,
@@ -558,8 +564,7 @@ public final class FileDownloader {
       throw DiffError.assetNotLaunch
     }
 
-    let baseAsset = try resolveLaunchAsset(launchedUpdate: launchedUpdate)
-    let baseFileUrl = try loadAndVerifyAsset(baseAsset)
+    let baseFileUrl = try resolveBaseFileUrl(launchedUpdate: launchedUpdate)
     let requestedUpdateId = requestedUpdate?.updateId.uuidString
 
     return try createPatchedAsset(
@@ -572,6 +577,19 @@ public final class FileDownloader {
     )
   }
 
+  private func resolveBaseFileUrl(launchedUpdate: Update) throws -> URL {
+    if launchedUpdate.status == UpdateStatus.StatusEmbedded {
+      // StatusEmbedded only launches for this binary's embedded update.
+      guard let embeddedLaunchAssetUrl else {
+        throw DiffError.embeddedBaseAssetMissing
+      }
+      return embeddedLaunchAssetUrl
+    }
+
+    let baseAsset = try resolveLaunchAsset(launchedUpdate: launchedUpdate)
+    return try loadAndVerifyAsset(baseAsset)
+  }
+
   private func resolveLaunchAsset(launchedUpdate: Update) throws -> UpdateAsset {
     let currentUpdateId = launchedUpdate.updateId
     var launchAsset: UpdateAsset?
@@ -1239,6 +1257,7 @@ extension FileDownloader {
     case missingHeader(String)
     case invalidHeader(String)
     case launchAssetNotFound
+    case embeddedBaseAssetMissing
     case baseAssetMissing(path: String)
     case failedToReadBaseAsset(cause: Error)
     case failedToWritePatch(cause: Error, path: String)
@@ -1266,6 +1285,8 @@ extension FileDownloader.DiffError: CustomStringConvertible {
       return "Invalid \(header) header"
     case .launchAssetNotFound:
       return "Launch asset not found for current update"
+    case .embeddedBaseAssetMissing:
+      return "Embedded bundle not found in the app binary"
     case let .baseAssetMissing(path):
       return "Base asset is missing at path \(path)"
     case let .failedToReadBaseAsset(cause):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-updates",
-  "version": "58.0.0",
+  "version": "58.0.2",
   "description": "Fetches and manages remotely-hosted assets and updates to your app's JS bundle.",
   "keywords": [
     "expo",
@@ -61,7 +61,7 @@
     "resolve-from": "^5.0.0"
   },
   "devDependencies": {
-    "@expo/metro-config": "58.0.0",
+    "@expo/metro-config": "58.0.1",
     "@testing-library/react-native": "^13.3.0",
     "@types/debug": "^4.1.7",
     "@types/getenv": "^1.0.0",
@@ -71,7 +71,7 @@
     "@types/picomatch": "^4.0.0",
     "@types/react": "~19.2.0",
     "@vercel/ncc": "^0.38.3",
-    "expo-dev-client": "58.0.0",
+    "expo-dev-client": "58.0.1",
     "expo-module-scripts": "56.0.3",
     "express": "^5.1.0",
     "form-data": "^4.0.4",
@@ -91,7 +91,7 @@
       "optional": true
     }
   },
-  "gitHead": "c543a7181fc32e14f42d89550087b80ac5c490f2",
+  "gitHead": "4b28ee36f9b7a8d87a39892ca94a3fedea409517",
   "scripts": {
     "build": "pnpm run build:lib && pnpm run build:plugin && pnpm run build:utils && pnpm run build:cli",
     "build:lib": "expo-build src",