expo-updates 58.0.7 → 58.0.9

package/CHANGELOG.md

@@ -10,6 +10,18 @@
 
 ### 💡 Others
 
+## 58.0.9 — 2026-09-25
+
+_This version does not introduce any user-facing changes._
+
+## 58.0.8 — 2026-09-23
+
+### 🐛 Bug fixes
+
+- Log a warning naming the event and its error message when the updates state machine drops an event that is not allowed from the current state. Previously such an event was discarded silently in release builds, so an error could disappear without a trace. ([#50163](https://github.com/expo/expo/pull/50163) by [@douglowder](https://github.com/douglowder))
+- Add an `EX_UPDATES_ASSERT_INVALID_STATE` build flag that makes the updates state machine stop the app when it drops an event, so an invalid transition fails an E2E run instead of passing unnoticed. ([#50163](https://github.com/expo/expo/pull/50163) by [@douglowder](https://github.com/douglowder))
+- [iOS] Fix `with-node.sh` ignoring the app's `NODE_BINARY` and `.xcode.env` when building without CocoaPods. ([#50084](https://github.com/expo/expo/pull/50084) by [@chrfalch](https://github.com/chrfalch))
+
 ## 58.0.7 — 2026-09-22
 
 _This version does not introduce any user-facing changes._
@@ -44,6 +56,8 @@ _This version does not introduce any user-facing changes._
 
 - [iOS] Apply bundle diffs against the embedded bundle in the app binary when the launched update is the embedded one, instead of failing to resolve a patch base and downloading the full bundle. ([#50018](https://github.com/expo/expo/pull/50018) by [@alanjhughes](https://github.com/alanjhughes))
 - [Android] Apply bundle diffs against the embedded bundle in the app binary when the launched update is the embedded one, instead of failing to resolve a patch base and downloading the full bundle. ([#50019](https://github.com/expo/expo/pull/50019) by [@alanjhughes](https://github.com/alanjhughes))
+- Fix issues with error propagation when `checkForUpdateAsync`, `fetchUpdateAsync`, `readLogEntriesAsync` and `clearLogEntriesAsync` reject with an error, so that error causes/reasons are preserved. ([#50098](https://github.com/expo/expo/pull/50098) by [@douglowder](https://github.com/douglowder))
+- [iOS] Report a startup update failure through `downloadError` when the updates state machine is idle, instead of dropping it, so that `useUpdates()` reflects background update failures as it already did on Android. ([#50098](https://github.com/expo/expo/pull/50098) by [@douglowder](https://github.com/douglowder))
 
 ## 58.0.0 — 2026-09-10
 

package/android/build.gradle

@@ -42,7 +42,7 @@ expoModule {
 }
 
 group = 'host.exp.exponent'
-version = '58.0.7'
+version = '58.0.9'
 
 // Utility method to derive boolean values from the environment or from Java properties,
 // and return them as strings to be used in BuildConfig fields
@@ -78,6 +78,11 @@ def exUpdatesAndroidDelayLoadApp = getBoolStringFromPropOrEnv("EX_UPDATES_ANDROI
 // If true, updates will copy embedded assets to file system when startup. (default false)
 def exUpdatesCopyEmbeddedAssets = getBoolStringFromPropOrEnv("EX_UPDATES_COPY_EMBEDDED_ASSETS", false)
 
+// If true, the state machine throws when it drops an event that is not allowed from the current
+// state, instead of only logging a warning. E2E tests turn this on so an invalid transition fails
+// the test run rather than passing unnoticed. (default false)
+def exUpdatesAssertInvalidState = getBoolStringFromPropOrEnv("EX_UPDATES_ASSERT_INVALID_STATE", false)
+
 def useDevClient = findProject(":expo-dev-client") != null
 
 def reactNativeArchitectures() {
@@ -98,7 +103,7 @@ android {
   namespace "expo.modules.updates"
   defaultConfig {
     versionCode 31
-    versionName '58.0.7'
+    versionName '58.0.9'
     consumerProguardFiles("proguard-rules.pro")
     testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
 
@@ -106,6 +111,7 @@ android {
     buildConfigField("boolean", "EX_UPDATES_CUSTOM_INIT", exUpdatesCustomInit)
     buildConfigField("boolean", "EX_UPDATES_ANDROID_DELAY_LOAD_APP", exUpdatesAndroidDelayLoadApp)
     buildConfigField("boolean", "EX_UPDATES_COPY_EMBEDDED_ASSETS", exUpdatesCopyEmbeddedAssets)
+    buildConfigField("boolean", "EX_UPDATES_ASSERT_INVALID_STATE", exUpdatesAssertInvalidState)
     buildConfigField("boolean", "USE_DEV_CLIENT", useDevClient.toString())
 
     externalNativeBuild {

package/android/src/main/java/expo/modules/updates/IUpdatesController.kt

@@ -4,6 +4,7 @@ import android.os.Bundle
 import com.facebook.react.ReactHost
 import com.facebook.react.bridge.ReactContext
 import com.facebook.react.devsupport.interfaces.DevSupportManager
+import expo.modules.core.logging.localizedMessageWithCauseLocalizedMessage
 import expo.modules.updates.db.entity.AssetEntity
 import expo.modules.updates.db.entity.UpdateEntity
 import expo.modules.updates.events.IUpdatesEventManager
@@ -104,7 +105,7 @@ interface IUpdatesController {
   ) {
     fun toModuleConstantsMap(): Map<String, Any?> = mutableMapOf<String, Any?>().apply {
       this["isEmergencyLaunch"] = emergencyLaunchException != null
-      this["emergencyLaunchReason"] = emergencyLaunchException?.message
+      this["emergencyLaunchReason"] = emergencyLaunchException?.localizedMessageWithCauseLocalizedMessage()
       this["isEmbeddedLaunch"] = embeddedUpdate !== null && launchedUpdate?.id?.equals(embeddedUpdate.id) ?: false
       this["isEnabled"] = isEnabled
       this["launchDuration"] = launchDuration?.toLong(DurationUnit.MILLISECONDS)

package/android/src/main/java/expo/modules/updates/UpdatesModule.kt

@@ -3,6 +3,7 @@ package expo.modules.updates
 import android.content.Context
 import android.net.Uri
 import android.os.Bundle
+import expo.modules.core.logging.localizedMessageWithCauseLocalizedMessage
 import expo.modules.kotlin.exception.CodedException
 import expo.modules.kotlin.exception.Exceptions
 import expo.modules.kotlin.functions.Coroutine
@@ -69,7 +70,11 @@ class UpdatesModule : Module(), IUpdatesEventManagerObserver {
     AsyncFunction("checkForUpdateAsync") Coroutine { ->
       when (val result = UpdatesController.instance.checkForUpdate()) {
         is IUpdatesController.CheckForUpdateResult.ErrorResult -> {
-          throw CodedException("ERR_UPDATES_CHECK", "Failed to check for update", result.error)
+          throw CodedException(
+            "ERR_UPDATES_CHECK",
+            "Failed to check for update: ${result.error.localizedMessageWithCauseLocalizedMessage()}",
+            result.error
+          )
         }
 
         is IUpdatesController.CheckForUpdateResult.NoUpdateAvailable -> {
@@ -103,7 +108,11 @@ class UpdatesModule : Module(), IUpdatesEventManagerObserver {
     AsyncFunction("fetchUpdateAsync") Coroutine { ->
       when (val result = UpdatesController.instance.fetchUpdate()) {
         is IUpdatesController.FetchUpdateResult.ErrorResult -> {
-          throw CodedException("ERR_UPDATES_FETCH", "Failed to download new update", result.error)
+          throw CodedException(
+            "ERR_UPDATES_FETCH",
+            "Failed to download new update: ${result.error.localizedMessageWithCauseLocalizedMessage()}",
+            result.error
+          )
         }
 
         is IUpdatesController.FetchUpdateResult.Failure -> {

package/android/src/main/java/expo/modules/updates/loader/FileDownloader.kt

@@ -2,6 +2,7 @@ package expo.modules.updates.loader
 
 import androidx.annotation.VisibleForTesting
 import com.facebook.react.modules.network.OkHttpClientProvider
+import expo.modules.core.logging.localizedMessageWithCauseLocalizedMessage
 import expo.modules.jsonutils.require
 import expo.modules.structuredheaders.Dictionary
 import expo.modules.structuredheaders.OuterList
@@ -699,6 +700,30 @@ class FileDownloader(
     )
   }
 
+  /**
+   * Summarizes an unsuccessful response for use as an error message. The status code is included
+   * because the body alone is often an opaque HTML page, and the body is truncated because it ends
+   * up in the error that `checkForUpdateAsync` and `fetchUpdateAsync` reject with.
+   */
+  private fun describeUnsuccessfulResponse(response: Response): String {
+    val body = try {
+      response.body?.string()
+    } catch (e: IOException) {
+      logger.warn("Could not read body of unsuccessful remote update response: ${e.localizedMessageWithCauseLocalizedMessage()}", UpdatesErrorCode.UpdateFailedToLoad)
+      null
+    }
+    val summary = body?.takeIf { it.isNotBlank() }?.let { truncateForErrorMessage(it) } ?: "Unknown error"
+    return "HTTP ${response.code}: $summary"
+  }
+
+  private fun truncateForErrorMessage(body: String): String {
+    return if (body.length <= MAX_ERROR_BODY_LENGTH) {
+      body
+    } else {
+      "${body.take(MAX_ERROR_BODY_LENGTH)}… (truncated, ${body.length} characters total)"
+    }
+  }
+
   suspend fun downloadRemoteUpdate(
     extraHeaders: JSONObject?
   ): UpdateResponse {
@@ -709,7 +734,7 @@ class FileDownloader(
 
       if (!response.isSuccessful) {
         val message = "Remote update request not successful"
-        val underlyingError = IOException(response.body?.string() ?: "Unknown error")
+        val underlyingError = IOException(describeUnsuccessfulResponse(response))
         logger.error(message, underlyingError, UpdatesErrorCode.UpdateFailedToLoad)
         throw IOException(message, underlyingError)
       }
@@ -983,6 +1008,8 @@ class FileDownloader(
   }
 
   companion object {
+    private const val MAX_ERROR_BODY_LENGTH = 512
+
     fun getExtraHeadersForRemoteUpdateRequest(
       database: UpdatesDatabase,
       configuration: UpdatesConfiguration,

package/android/src/main/java/expo/modules/updates/procedures/FetchUpdateProcedure.kt

@@ -1,6 +1,7 @@
 package expo.modules.updates.procedures
 
 import android.content.Context
+import expo.modules.core.logging.localizedMessageWithCauseLocalizedMessage
 import expo.modules.updates.IUpdatesController
 import expo.modules.updates.UpdatesConfiguration
 import expo.modules.updates.db.UpdatesDatabase
@@ -41,7 +42,7 @@ class FetchUpdateProcedure(
     } catch (e: Exception) {
       logger.error("Failed to download new update", e)
       procedureContext.processStateEvent(
-        UpdatesStateEvent.DownloadError("Failed to download new update: ${e.message}")
+        UpdatesStateEvent.DownloadError("Failed to download new update: ${e.localizedMessageWithCauseLocalizedMessage()}")
       )
       callback(IUpdatesController.FetchUpdateResult.ErrorResult(e))
     } finally {

package/android/src/main/java/expo/modules/updates/procedures/StartupProcedure.kt

@@ -2,6 +2,7 @@ package expo.modules.updates.procedures
 
 import android.content.Context
 import com.facebook.react.devsupport.interfaces.DevSupportManager
+import expo.modules.core.logging.localizedMessageWithCauseLocalizedMessage
 import expo.modules.updates.UpdatesConfiguration
 import expo.modules.updates.db.BuildData
 import expo.modules.updates.db.UpdatesDatabase
@@ -164,18 +165,18 @@ class StartupProcedure(
               UpdatesStateValue.Idle -> {
                 procedureContext.processStateEvent(UpdatesStateEvent.Download())
                 procedureContext.processStateEvent(
-                  UpdatesStateEvent.DownloadError(exception.message ?: "")
+                  UpdatesStateEvent.DownloadError(exception.localizedMessageWithCauseLocalizedMessage())
                 )
               }
               UpdatesStateValue.Checking -> {
                 procedureContext.processStateEvent(
-                  UpdatesStateEvent.CheckError(exception.message ?: "")
+                  UpdatesStateEvent.CheckError(exception.localizedMessageWithCauseLocalizedMessage())
                 )
               }
               else -> {
                 // .downloading
                 procedureContext.processStateEvent(
-                  UpdatesStateEvent.DownloadError(exception.message ?: "")
+                  UpdatesStateEvent.DownloadError(exception.localizedMessageWithCauseLocalizedMessage())
                 )
               }
             }

package/android/src/main/java/expo/modules/updates/statemachine/UpdatesStateMachine.kt

@@ -1,6 +1,7 @@
 package expo.modules.updates.statemachine
 
 import expo.modules.manifests.core.toMap
+import expo.modules.updates.BuildConfig
 import expo.modules.updates.EnabledUpdatesController
 import expo.modules.updates.events.IUpdatesEventManager
 import expo.modules.updates.logging.UpdatesLogger
@@ -114,18 +115,46 @@ class UpdatesStateMachine(
   private fun transition(event: UpdatesStateEvent): Boolean {
     val allowedEvents: Set<UpdatesStateEventType> = updatesStateAllowedEvents[state] ?: setOf()
     if (!allowedEvents.contains(event.type)) {
-      assert(false) { "UpdatesState: invalid transition requested: state = $state, event = ${event.type}" }
+      reportDroppedEvent(event)
       return false
     }
     val newStateValue = updatesStateTransitions[event.type] ?: UpdatesStateValue.Idle
     if (!validUpdatesStateValues.contains(newStateValue)) {
-      assert(false) { "UpdatesState: invalid transition requested: state = $state, event = ${event.type}" }
+      reportDroppedEvent(event)
       return false
     }
     state = newStateValue
     return true
   }
 
+  /**
+   Records an event the machine cannot process. The drop is always logged, so it is visible through
+   `readLogEntriesAsync` in a shipping app. With EX_UPDATES_ASSERT_INVALID_STATE the drop also
+   throws, so an invalid transition fails an E2E run instead of passing unnoticed.
+   */
+  private fun reportDroppedEvent(event: UpdatesStateEvent) {
+    val message = droppedEventWarning(event)
+    logger.warn(message)
+    if (BuildConfig.EX_UPDATES_ASSERT_INVALID_STATE) {
+      throw AssertionError(message)
+    }
+  }
+
+  /**
+   The warning written when an event is dropped. It carries the error text of an error event,
+   because some callers do not log the failure themselves before sending the event, which would
+   leave the updates log with no record of what was lost.
+   */
+  private fun droppedEventWarning(event: UpdatesStateEvent): String {
+    val errorMessage = when (event) {
+      is UpdatesStateEvent.CheckError -> event.error.message
+      is UpdatesStateEvent.DownloadError -> event.error.message
+      else -> null
+    }
+    val error = errorMessage?.let { ", error = $it" } ?: ""
+    return "UpdatesState: invalid transition requested, event dropped: state = $state, event = ${event.type}$error"
+  }
+
   fun sendContextToJS() {
     eventManager.sendStateMachineContextEvent(context)
   }

package/expo-updates-gradle-plugin/.gradle/buildOutputCleanup/cache.properties

@@ -1,2 +1,2 @@
-#Mon Sep 21 11:42:05 IST 2026
+#Fri Sep 25 09:12:16 IST 2026
 gradle.version=9.4.1

package/ios/EXUpdates/AppLoader/FileDownloader.swift

@@ -40,8 +40,22 @@ private extension String {
 
     return self
   }
+
+  /**
+   Truncates a response body for inclusion in an error message. The message reaches JavaScript and
+   crash reporters, so an unbounded body (typically an HTML error page) must not be embedded whole.
+   Mirrors `MAX_ERROR_BODY_LENGTH` in the Android `FileDownloader`.
+   */
+  func truncatedForErrorMessage() -> String {
+    if count <= maxErrorBodyLength {
+      return self
+    }
+    return "\(prefix(maxErrorBodyLength))… (truncated, \(count) characters total)"
+  }
 }
 
+private let maxErrorBodyLength = 512
+
 private extension Dictionary where Iterator.Element == (key: String, value: Any) {
   func stringValueForCaseInsensitiveKey(_ searchKey: Key) -> String? {
     let valueRaw = self.first { (key: Key, _: Value) in
@@ -1219,7 +1233,7 @@ public final class FileDownloader {
         httpResponse.statusCode < 200 || httpResponse.statusCode >= 300 {
         let encoding = FileDownloader.encoding(fromResponse: httpResponse)
         let body = data.let { it in
-          String(data: it, encoding: encoding)
+          String(data: it, encoding: encoding)?.truncatedForErrorMessage()
         } ?? "Unknown body response"
         let cause = UpdatesError.fileDownloaderHTTPResponseError(statusCode: httpResponse.statusCode, body: body)
         self.logger.error(cause: cause, code: .unknown)

package/ios/EXUpdates/Exceptions.swift

@@ -99,4 +99,57 @@ internal final class InvalidRequestHeadersOverrideException: Exception {
   }
 }
 
+/**
+ * Base class for exceptions that wrap an underlying error and need its description to reach
+ * JavaScript. Subclasses override `reason` to include the underlying error's description.
+ */
+internal class UpdatesUnderlyingErrorException: Exception, @unchecked Sendable {
+  internal let underlyingError: Error
+
+  internal init(_ underlyingError: Error, file: String = #fileID, line: UInt = #line, function: String = #function) {
+    self.underlyingError = underlyingError
+    super.init(file: file, line: line, function: function)
+  }
+}
+
+internal final class CheckForUpdateException: UpdatesUnderlyingErrorException, @unchecked Sendable {
+  override var code: String {
+    "ERR_UPDATES_CHECK"
+  }
+
+  override var reason: String {
+    "Failed to check for update: \(underlyingError.localizedDescription)"
+  }
+}
+
+internal final class FetchUpdateException: UpdatesUnderlyingErrorException, @unchecked Sendable {
+  override var code: String {
+    "ERR_UPDATES_FETCH"
+  }
+
+  override var reason: String {
+    "Failed to download new update: \(underlyingError.localizedDescription)"
+  }
+}
+
+internal final class ReadLogEntriesException: UpdatesUnderlyingErrorException, @unchecked Sendable {
+  override var code: String {
+    "ERR_UPDATES_READ_LOGS"
+  }
+
+  override var reason: String {
+    "Failed to read log entries: \(underlyingError.localizedDescription)"
+  }
+}
+
+internal final class ClearLogEntriesException: UpdatesUnderlyingErrorException, @unchecked Sendable {
+  override var code: String {
+    "ERR_UPDATES_READ_LOGS"
+  }
+
+  override var reason: String {
+    "Failed to clear log entries: \(underlyingError.localizedDescription)"
+  }
+}
+
 // swiftlint:enable line_length

package/ios/EXUpdates/Procedures/StartupProcedure.swift

@@ -211,10 +211,21 @@ final class StartupProcedure: StateMachineProcedure, AppLoaderTaskDelegate, AppL
       )
       // Since errors can happen through a number of paths, we do these checks
       // to make sure the state machine is valid
-      if self.procedureContext.getCurrentState() == .checking {
+      switch self.procedureContext.getCurrentState() {
+      case .checking:
         self.procedureContext.processStateEvent(.checkError(errorMessage: error.localizedDescription))
-      } else if self.procedureContext.getCurrentState() == .downloading {
+      case .downloading:
         self.procedureContext.processStateEvent(.downloadError(errorMessage: error.localizedDescription))
+      case .idle:
+        // `downloadError` on its own is an illegal transition out of idle and would be dropped,
+        // leaving `useUpdates()` with no record of the failure. Move into the downloading state
+        // first, as the Android implementation does.
+        self.procedureContext.processStateEvent(.download)
+        self.procedureContext.processStateEvent(.downloadError(errorMessage: error.localizedDescription))
+      case .restarting:
+        // The machine accepts no events while restarting, so there is nowhere to report this. The
+        // error is already recorded in the log above.
+        logger.warn(message: "Background update failed while restarting: \(error.localizedDescription)")
       }
     case .updateAvailable:
       remoteLoadStatus = .NewUpdateLoaded

package/ios/EXUpdates/UpdatesModule.swift

@@ -68,7 +68,7 @@ public final class UpdatesModule: Module, UpdatesEventManagerObserver {
           ])
           return
         case .error(let error):
-          promise.reject("ERR_UPDATES_CHECK", error.localizedDescription)
+          promise.reject(CheckForUpdateException(error))
           return
         }
       } error: { error in
@@ -97,7 +97,7 @@ public final class UpdatesModule: Module, UpdatesEventManagerObserver {
       do {
         return try UpdatesLogReader().getLogEntries(newerThan: Date(timeIntervalSinceNow: TimeInterval(-1 * (maxAge / 1000))))
       } catch {
-        throw Exception(name: "ERR_UPDATES_READ_LOGS", description: error.localizedDescription)
+        throw ReadLogEntriesException(error)
       }
     }
 
@@ -107,7 +107,7 @@ public final class UpdatesModule: Module, UpdatesEventManagerObserver {
           promise.resolve(nil)
           return
         }
-        promise.reject("ERR_UPDATES_READ_LOGS", error.localizedDescription)
+        promise.reject(ClearLogEntriesException(error))
       }
     }
 
@@ -134,7 +134,7 @@ public final class UpdatesModule: Module, UpdatesEventManagerObserver {
           ])
           return
         case .error(let error):
-          promise.reject("ERR_UPDATES_FETCH", error.localizedDescription)
+          promise.reject(FetchUpdateException(error))
           return
         }
       } error: { error in

package/ios/EXUpdates/UpdatesStateMachine.swift

@@ -89,6 +89,23 @@ internal enum UpdatesStateEvent {
     }
   }
 
+  /**
+   The failure text carried by an error event. The state machine logs it when it drops an event,
+   so the message does not disappear with the event.
+   */
+  var errorMessage: String? {
+    switch self {
+    case let .checkError(errorMessage):
+      return errorMessage
+    case let .downloadError(errorMessage):
+      return errorMessage
+    case .startStartup, .endStartup, .check, .checkCompleteUnavailable, .checkCompleteWithUpdate,
+      .checkCompleteWithRollback, .download, .downloadCompleteUnavailable, .downloadCompleteWithUpdate,
+      .downloadCompleteWithRollback, .downloadProgress, .restart:
+      return nil
+    }
+  }
+
   var toMap: [String: Any] {
     switch self {
     case .checkCompleteWithUpdate(manifest: let manifest):
@@ -418,12 +435,12 @@ internal class UpdatesStateMachine {
   private func transition(_ event: UpdatesStateEvent) -> Bool {
     let allowedEvents: Set<UpdatesStateEvent.InternalType> = UpdatesStateMachine.updatesStateAllowedEvents[state] ?? []
     if !allowedEvents.contains(event.type) {
-      assertionFailure("UpdatesState: invalid transition requested: state = \(state), event = \(event.type)")
+      reportDroppedEvent(event)
       return false
     }
     let newStateValue = UpdatesStateMachine.updatesStateTransitions[event.type] ?? .idle
     if !validUpdatesStateValues.contains(newStateValue) {
-      assertionFailure("UpdatesState: invalid transition requested: state = \(state), event = \(event.type)")
+      reportDroppedEvent(event)
       return false
     }
     // Successful transition
@@ -431,6 +448,29 @@ internal class UpdatesStateMachine {
     return true
   }
 
+  /**
+   Records an event the machine cannot process. The drop is always logged, so it is visible through
+   `readLogEntriesAsync` in a shipping app. With EX_UPDATES_ASSERT_INVALID_STATE the drop also
+   traps, so an invalid transition fails an E2E run instead of passing unnoticed.
+   */
+  private func reportDroppedEvent(_ event: UpdatesStateEvent) {
+    let message = droppedEventWarning(event)
+    logger.warn(message: message)
+    #if EX_UPDATES_ASSERT_INVALID_STATE
+    preconditionFailure(message)
+    #endif
+  }
+
+  /**
+   The warning written when an event is dropped. It carries the error text of an error event,
+   because some callers do not log the failure themselves before sending the event, which would
+   leave the updates log with no record of what was lost.
+   */
+  private func droppedEventWarning(_ event: UpdatesStateEvent) -> String {
+    let error = event.errorMessage.map { ", error = \($0)" } ?? ""
+    return "UpdatesState: invalid transition requested, event dropped: state = \(state), event = \(event.type)\(error)"
+  }
+
   /**
    Given an allowed event and a context, return a new context with the changes
    made by processing the event.
@@ -547,8 +587,8 @@ internal class UpdatesStateMachine {
 
   /**
    For a particular machine state, only certain events may be processed.
-   If the machine receives an unexpected event, an assertion failure will occur
-   and the app will crash.
+   If the machine receives an unexpected event, the event is dropped and a warning
+   is written to the updates log.
    */
   private static let updatesStateAllowedEvents: [UpdatesStateValue: Set<UpdatesStateEvent.InternalType>] = [
     .idle: [.startStartup, .endStartup, .check, .download, .restart],

package/ios/EXUpdates.podspec

@@ -78,6 +78,11 @@ Pod::Spec.new do |s|
   ex_updates_native_debug = ENV['EX_UPDATES_NATIVE_DEBUG'] == '1'
   ex_updates_custom_init = ENV['EX_UPDATES_CUSTOM_INIT'] == '1'
   ex_updates_copy_embedded_assets = ENV['EX_UPDATES_COPY_EMBEDDED_ASSETS'] == '1'
+  # If set, the state machine traps when it drops an event that is not allowed from the current
+  # state, instead of only logging a warning. E2E tests turn this on so an invalid transition fails
+  # the test run rather than passing unnoticed. Both '1' and 'true' are accepted, so the same value
+  # works here and in the Android Gradle build.
+  ex_updates_assert_invalid_state = ['1', 'true'].include?(ENV['EX_UPDATES_ASSERT_INVALID_STATE'].to_s.downcase)
   if ex_updates_native_debug
     other_debug_c_flags << ' -DEX_UPDATES_NATIVE_DEBUG=1'
     other_debug_swift_flags << ' -DEX_UPDATES_NATIVE_DEBUG'
@@ -94,6 +99,12 @@ Pod::Spec.new do |s|
     other_release_c_flags << ' -DEX_UPDATES_COPY_EMBEDDED_ASSETS=1'
     other_release_swift_flags << ' -DEX_UPDATES_COPY_EMBEDDED_ASSETS'
   end
+  if ex_updates_assert_invalid_state
+    other_debug_c_flags << ' -DEX_UPDATES_ASSERT_INVALID_STATE=1'
+    other_debug_swift_flags << ' -DEX_UPDATES_ASSERT_INVALID_STATE'
+    other_release_c_flags << ' -DEX_UPDATES_ASSERT_INVALID_STATE=1'
+    other_release_swift_flags << ' -DEX_UPDATES_ASSERT_INVALID_STATE'
+  end
   if use_dev_client
     other_debug_c_flags << ' -DUSE_DEV_CLIENT=1'
     other_debug_swift_flags << ' -DUSE_DEV_CLIENT'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-updates",
-  "version": "58.0.7",
+  "version": "58.0.9",
   "description": "Fetches and manages remotely-hosted assets and updates to your app's JS bundle.",
   "keywords": [
     "expo",
@@ -71,7 +71,7 @@
     "@types/picomatch": "^4.0.0",
     "@types/react": "~19.3.0",
     "@vercel/ncc": "^0.38.3",
-    "expo-dev-client": "58.0.5",
+    "expo-dev-client": "58.0.7",
     "expo-module-scripts": "56.0.3",
     "express": "^5.1.0",
     "form-data": "^4.0.4",
@@ -91,7 +91,7 @@
       "optional": true
     }
   },
-  "gitHead": "add8cbf49f477cfd2283ae05af35b4713a773c55",
+  "gitHead": "ad41d067bd3df6dd12f1788acc6b54a68e7a650d",
   "scripts": {
     "build": "pnpm run build:lib && pnpm run build:plugin && pnpm run build:utils && pnpm run build:cli",
     "build:lib": "expo-build src",

package/scripts/with-node.sh

@@ -9,20 +9,38 @@
 
 CURR_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
 
-# Start with a default
-NODE_BINARY=$(command -v node)
+# CocoaPods sets PODS_ROOT, and its env files override any inherited NODE_BINARY.
+# Without CocoaPods (SwiftPM) the calling build phase may already have resolved
+# NODE_BINARY, so keep it and read the app's env files from SRCROOT only if unset.
+# The mode is fixed here because the env files may change PODS_ROOT.
+if [[ -n "$PODS_ROOT" ]]; then
+  USES_COCOAPODS=1
+  # Start with a default
+  NODE_BINARY=$(command -v node)
+  ENV_PATH="$PODS_ROOT/../.xcode.env"
+else
+  USES_COCOAPODS=
+  ENV_PATH="$SRCROOT/.xcode.env"
+fi
 export NODE_BINARY
 
-# Override the default with the global environment
-ENV_PATH="$PODS_ROOT/../.xcode.env"
-if [[ -f "$ENV_PATH" ]]; then
-  source "$ENV_PATH"
+if [[ -n "$USES_COCOAPODS" || -z "$NODE_BINARY" ]]; then
+  # Override the default with the global environment
+  if [[ -f "$ENV_PATH" ]]; then
+    source "$ENV_PATH"
+  fi
+
+  # Override the global with the local environment
+  LOCAL_ENV_PATH="${ENV_PATH}.local"
+  if [[ -f "$LOCAL_ENV_PATH" ]]; then
+    source "$LOCAL_ENV_PATH"
+  fi
 fi
 
-# Override the global with the local environment
-LOCAL_ENV_PATH="${ENV_PATH}.local"
-if [[ -f "$LOCAL_ENV_PATH" ]]; then
-  source "$LOCAL_ENV_PATH"
+if [[ -z "$USES_COCOAPODS" ]]; then
+  NODE_BINARY="${NODE_BINARY:-$(command -v node)}"
+  # An env file that unsets NODE_BINARY also drops its export.
+  export NODE_BINARY
 fi
 
 if [[ -n "$NODE_BINARY" && -x "$NODE_BINARY" ]]; then