react-native-update-cli 1.41.0 → 1.42.1

package/lib/app.js

@@ -103,7 +103,8 @@ const commands = {
         const platform = checkPlatform(options.platform || await (0, _utils.question)('平台(ios/android/harmony):'));
         const { id } = await (0, _api.post)('/app/create', {
             name,
-            platform
+            platform,
+            downloadUrl
         });
         console.log(`已成功创建应用（id: ${id}）`);
         await this.selectApp({
@@ -111,8 +112,7 @@ const commands = {
                 id
             ],
             options: {
-                platform,
-                downloadUrl
+                platform
             }
         });
     },

package/lib/bundle.js

@@ -28,6 +28,7 @@ const _app = require("./app");
 const _nodechild_process = require("node:child_process");
 const _satisfies = /*#__PURE__*/ _interop_require_default(require("semver/functions/satisfies"));
 const _nodeos = /*#__PURE__*/ _interop_require_default(require("node:os"));
+const _depversions = require("./utils/dep-versions");
 function _interop_require_default(obj) {
     return obj && obj.__esModule ? obj : {
         default: obj
@@ -123,15 +124,15 @@ async function runReactNativeBundleCommand({ bundleName, dev, entryFile, outputF
     };
     const getRnCli = ()=>{
         try {
-            // rn >= 0.75
-            cliPath = require.resolve('@react-native-community/cli/build/bin.js', {
+            // rn < 0.75
+            cliPath = require.resolve('react-native/local-cli/cli.js', {
                 paths: [
                     process.cwd()
                 ]
             });
         } catch (e) {
-            // rn < 0.75
-            cliPath = require.resolve('react-native/local-cli/cli.js', {
+            // rn >= 0.75
+            cliPath = require.resolve('@react-native-community/cli/build/bin.js', {
                 paths: [
                     process.cwd()
                 ]
@@ -766,8 +767,7 @@ const commands = {
         if (!platform) {
             throw new Error('Platform must be specified.');
         }
-        const { version, major, minor } = (0, _utils.getRNVersion)();
-        console.log(`Bundling with react-native: ${version}`);
+        console.log(`Bundling with react-native: ${_depversions.depVersions['react-native']}`);
         await runReactNativeBundleCommand({
             bundleName,
             dev,

package/lib/index.js

@@ -7,34 +7,23 @@ const _api = require("./api");
 const _updatenotifier = /*#__PURE__*/ _interop_require_default(require("update-notifier"));
 const _utils = require("./utils");
 const _packagejson = /*#__PURE__*/ _interop_require_default(require("../package.json"));
-const _i18next = /*#__PURE__*/ _interop_require_default(require("i18next"));
-const _en = /*#__PURE__*/ _interop_require_default(require("./locales/en"));
-const _zh = /*#__PURE__*/ _interop_require_default(require("./locales/zh"));
-const _constants = require("./utils/constants");
+const _i18n = require("./utils/i18n");
 function _interop_require_default(obj) {
     return obj && obj.__esModule ? obj : {
         default: obj
     };
 }
-_i18next.default.init({
-    lng: _constants.IS_CRESC ? 'en' : 'zh',
-    // debug: process.env.NODE_ENV !== 'production',
-    resources: {
-        en: _en.default,
-        zh: _zh.default
-    }
-});
 (0, _updatenotifier.default)({
     pkg: _packagejson.default
 }).notify({
     isGlobal: true,
-    message: '建议运行 `{updateCommand}` 来更新命令行工具以获得功能、性能和安全性的持续改进'
+    message: (0, _i18n.t)('updateNotifier')
 });
 function printUsage() {
     // const commandName = args[0];
     // TODO: print usage of commandName, or print global usage.
     console.log('Usage is under development now.');
-    console.log('Visit `https://github.com/reactnativecn/react-native-pushy` for early document.');
+    console.log('Visit `https://github.com/reactnativecn/react-native-update` for document.');
     process.exit(1);
 }
 const commands = {
@@ -55,7 +44,7 @@ async function run() {
     global.USE_ACC_OSS = argv.options.acc;
     (0, _api.loadSession)().then(()=>commands[argv.command](argv)).catch((err)=>{
         if (err.status === 401) {
-            console.log('尚未登录。\n请在项目目录中运行`pushy login`命令来登录');
+            console.log((0, _i18n.t)('loginFirst'));
             return;
         }
         console.error(err.stack);

package/lib/locales/en.js

@@ -8,4 +8,16 @@ Object.defineProperty(exports, "default", {
         return _default;
     }
 });
-const _default = {};
+const _default = {
+    updateNotifier: 'Run `{updateCommand}` to update the CLI to get continuous improvements in features, performance, and security.',
+    loginFirst: 'Not logged in.\nPlease run `cresc login` in the project directory to login.',
+    lockNotFound: 'No lock file detected, which may cause inconsistent dependencies and hot-updating issues.',
+    multipleLocksFound: 'Multiple lock files detected ({lockFiles}), which may cause inconsistent dependencies and hot-updating issues.',
+    lockBestPractice: `
+Best practices for lock files:
+1. All members of the development team should use the same package manager to maintain a single lock file.
+2. Add the lock file to version control (but do not commit multiple lock files of different formats).
+3. Pay attention to changes in the lock file during code review.
+This can reduce the risk of inconsistent dependencies and supply chain attacks.
+`
+};

package/lib/locales/zh.js

@@ -8,4 +8,16 @@ Object.defineProperty(exports, "default", {
         return _default;
     }
 });
-const _default = {};
+const _default = {
+    updateNotifier: '建议运行 `{updateCommand}` 来更新命令行工具以获得功能、性能和安全性的持续改进',
+    loginFirst: '尚未登录。\n请在项目目录中运行`pushy login`命令来登录',
+    lockNotFound: '没有检测到任何 lock 文件，这可能导致依赖关系不一致而使热更异常。',
+    lockBestPractice: `
+关于 lock 文件的最佳实践：
+1. 开发团队中的所有成员应该使用相同的包管理器，维护同一份 lock 文件。
+2. 将 lock 文件添加到版本控制中（但不要同时提交多种不同格式的 lock 文件）。
+3. 代码审核时应关注 lock 文件的变化。
+这样可以最大限度避免因依赖关系不一致而导致的热更异常，也降低供应链攻击等安全隐患。
+`,
+    multipleLocksFound: '检测到多种不同格式的锁文件({lockFiles})，这可能导致依赖关系不一致而使热更异常。'
+};

package/lib/package.js

@@ -23,6 +23,8 @@ const _api = require("./api");
 const _utils = require("./utils");
 const _app = require("./app");
 const _ttytable = /*#__PURE__*/ _interop_require_default(require("tty-table"));
+const _depversions = require("./utils/dep-versions");
+const _git = require("./utils/git");
 function _interop_require_default(obj) {
     return obj && obj.__esModule ? obj : {
         default: obj
@@ -92,7 +94,9 @@ const commands = {
         const { id } = await (0, _api.post)(`/app/${appId}/package/create`, {
             name: versionName,
             hash,
-            buildTime
+            buildTime,
+            deps: _depversions.depVersions,
+            commit: await (0, _git.getCommitInfo)()
         });
         (0, _utils.saveToLocal)(fn, `${appId}/package/${id}.ipa`);
         console.log(`已成功上传ipa原生包（id: ${id}, version: ${versionName}, buildTime: ${buildTime}）`);
@@ -114,7 +118,9 @@ const commands = {
         const { id } = await (0, _api.post)(`/app/${appId}/package/create`, {
             name: versionName,
             hash,
-            buildTime
+            buildTime,
+            deps: _depversions.depVersions,
+            commit: await (0, _git.getCommitInfo)()
         });
         (0, _utils.saveToLocal)(fn, `${appId}/package/${id}.apk`);
         console.log(`已成功上传apk原生包（id: ${id}, version: ${versionName}, buildTime: ${buildTime}）`);
@@ -136,7 +142,9 @@ const commands = {
         const { id } = await (0, _api.post)(`/app/${appId}/package/create`, {
             name: versionName,
             hash,
-            buildTime
+            buildTime,
+            deps: _depversions.depVersions,
+            commit: await (0, _git.getCommitInfo)()
         });
         (0, _utils.saveToLocal)(fn, `${appId}/package/${id}.app`);
         console.log(`已成功上传app原生包（id: ${id}, version: ${versionName}, buildTime: ${buildTime}）`);

package/lib/utils/app-info-parser/utils.js

@@ -27,7 +27,7 @@ function isBrowser() {
     iteratorObj(apkInfo);
     return apkInfo;
     function iteratorObj(obj) {
-        for(var i in obj){
+        for(const i in obj){
             if (isArray(obj[i])) {
                 iteratorArray(obj[i]);
             } else if (isObject(obj[i])) {

package/lib/utils/dep-versions.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "depVersions", {
+    enumerable: true,
+    get: function() {
+        return depVersions;
+    }
+});
+const currentPackage = require(`${process.cwd()}/package.json`);
+const depKeys = Object.keys(currentPackage.dependencies);
+const devDepKeys = Object.keys(currentPackage.devDependencies);
+const dedupedDeps = [
+    ...new Set([
+        ...depKeys,
+        ...devDepKeys
+    ])
+];
+const _depVersions = {};
+for (const dep of dedupedDeps){
+    try {
+        const packageJsonPath = require.resolve(`${dep}/package.json`, {
+            paths: [
+                process.cwd()
+            ]
+        });
+        const version = require(packageJsonPath).version;
+        _depVersions[dep] = version;
+    } catch (e) {}
+}
+const depVersions = Object.keys(_depVersions).sort() // Sort the keys alphabetically
+.reduce((obj, key)=>{
+    obj[key] = _depVersions[key]; // Rebuild the object with sorted keys
+    return obj;
+}, {}); // console.log({ depVersions });

package/lib/utils/git.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "getCommitInfo", {
+    enumerable: true,
+    get: function() {
+        return getCommitInfo;
+    }
+});
+const _isomorphicgit = /*#__PURE__*/ _interop_require_default(require("isomorphic-git"));
+const _nodefs = /*#__PURE__*/ _interop_require_default(require("node:fs"));
+const _nodepath = /*#__PURE__*/ _interop_require_default(require("node:path"));
+function _interop_require_default(obj) {
+    return obj && obj.__esModule ? obj : {
+        default: obj
+    };
+}
+function findGitRoot(dir = process.cwd()) {
+    const gitRoot = _nodefs.default.readdirSync(dir).find((dir)=>dir === '.git');
+    if (gitRoot) {
+        // console.log({ gitRoot });
+        return _nodepath.default.join(dir, gitRoot);
+    }
+    const parentDir = _nodepath.default.dirname(dir);
+    if (parentDir === dir) {
+        return null;
+    }
+    return findGitRoot(parentDir);
+}
+const gitRoot = findGitRoot();
+async function getCommitInfo() {
+    if (!gitRoot) {
+        return;
+    }
+    try {
+        const remotes = await _isomorphicgit.default.listRemotes({
+            fs: _nodefs.default,
+            gitdir: gitRoot
+        });
+        const origin = remotes.find((remote)=>remote.remote === 'origin') || remotes[0];
+        const { commit, oid } = (await _isomorphicgit.default.log({
+            fs: _nodefs.default,
+            gitdir: gitRoot,
+            depth: 1
+        }))[0];
+        return {
+            hash: oid,
+            message: commit.message,
+            author: commit.author.name || commit.committer.name,
+            timestamp: String(commit.committer.timestamp),
+            origin: origin.url
+        };
+    } catch (error) {
+        console.error(error);
+        return;
+    }
+}

package/lib/utils/i18n.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "t", {
+    enumerable: true,
+    get: function() {
+        return t;
+    }
+});
+const _i18next = /*#__PURE__*/ _interop_require_default(require("i18next"));
+const _en = /*#__PURE__*/ _interop_require_default(require("../locales/en"));
+const _zh = /*#__PURE__*/ _interop_require_default(require("../locales/zh"));
+const _constants = require("./constants");
+function _interop_require_default(obj) {
+    return obj && obj.__esModule ? obj : {
+        default: obj
+    };
+}
+_i18next.default.init({
+    lng: _constants.IS_CRESC ? 'en' : 'zh',
+    // debug: process.env.NODE_ENV !== 'production',
+    resources: {
+        en: _en.default,
+        zh: _zh.default
+    }
+});
+const t = _i18next.default.t;

package/lib/utils/index.js

@@ -21,9 +21,6 @@ _export(exports, {
     getIpaInfo: function() {
         return getIpaInfo;
     },
-    getRNVersion: function() {
-        return getRNVersion;
-    },
     printVersionCommand: function() {
         return printVersionCommand;
     },
@@ -48,6 +45,7 @@ const _latestversion = /*#__PURE__*/ _interop_require_default(require("@badisi/l
 const _checkplugin = require("./check-plugin");
 const _read = require("read");
 const _constants = require("./constants");
+const _depversions = require("./dep-versions");
 function _interop_require_default(obj) {
     return obj && obj.__esModule ? obj : {
         default: obj
@@ -75,19 +73,6 @@ function translateOptions(options) {
     }
     return ret;
 }
-function getRNVersion() {
-    const version = JSON.parse(_fsextra.default.readFileSync(require.resolve('react-native/package.json', {
-        paths: [
-            process.cwd()
-        ]
-    })).toString()).version;
-    const [, major, minor] = /^(\d+)\.(\d+)\./.exec(version) || [];
-    return {
-        version,
-        major: Number(major),
-        minor: Number(minor)
-    };
-}
 async function getApkInfo(fn) {
     const appInfoParser = new _appinfoparser.default(fn);
     const bundleFile = await appInfoParser.parser.getEntry(/assets\/index.android.bundle/);
@@ -184,7 +169,7 @@ function saveToLocal(originPath, destName) {
 }
 async function getLatestVersion(pkgNames) {
     return (0, _latestversion.default)(pkgNames, {
-        useCache: true,
+        // useCache: true,
         requestOptions: {
             timeout: 2000
         }
@@ -198,18 +183,9 @@ async function printVersionCommand() {
     latestPushyCliVersion = latestPushyCliVersion ? ` （最新：${_chalk.default.green(latestPushyCliVersion)}）` : '';
     console.log(`react-native-update-cli: ${_packagejson.default.version}${latestPushyCliVersion}`);
     let pushyVersion = '';
-    try {
-        const PACKAGE_JSON_PATH = require.resolve('react-native-update/package.json', {
-            paths: [
-                process.cwd()
-            ]
-        });
-        pushyVersion = require(PACKAGE_JSON_PATH).version;
-        latestPushyVersion = latestPushyVersion ? ` （最新：${_chalk.default.green(latestPushyVersion)}）` : '';
-        console.log(`react-native-update: ${pushyVersion}${latestPushyVersion}`);
-    } catch (e) {
-        console.log('react-native-update: 无法获取版本号，请在项目目录中运行命令');
-    }
+    pushyVersion = _depversions.depVersions['react-native-update'];
+    latestPushyVersion = latestPushyVersion ? ` （最新：${_chalk.default.green(latestPushyVersion)}）` : '';
+    console.log(`react-native-update: ${pushyVersion}${latestPushyVersion}`);
     if (pushyVersion) {
         if ((0, _satisfies.default)(pushyVersion, '<8.5.2')) {
             console.warn(`当前版本已不再支持，请至少升级到 v8 的最新小版本后重新打包（代码无需改动）: npm i react-native-update@8 .
@@ -220,5 +196,7 @@ async function printVersionCommand() {
         } else if ((0, _satisfies.default)(pushyVersion, '10.0.0 - 10.17.0')) {
             console.warn('当前版本已不再支持，请升级到 v10 的最新小版本（代码无需改动，可直接热更）: npm i react-native-update@10');
         }
+    } else {
+        console.log('react-native-update: 无法获取版本号，请在项目目录中运行命令');
     }
 }

package/lib/utils/lock-checker.js

@@ -0,0 +1,8 @@
+"use strict";
+const lockFiles = [
+    'package-lock.json',
+    'yarn.lock',
+    'pnpm-lock.yaml',
+    'bun.lockb',
+    'bun.lock'
+];

package/lib/versions.js

@@ -13,16 +13,18 @@ const _utils = require("./utils");
 const _app = require("./app");
 const _package = require("./package");
 const _compareversions = require("compare-versions");
+const _depversions = require("./utils/dep-versions");
+const _git = require("./utils/git");
 async function showVersion(appId, offset) {
     const { data, count } = await (0, _api.get)(`/app/${appId}/version/list`);
     console.log(`Offset ${offset}`);
     for (const version of data){
         let packageInfo = version.packages.slice(0, 3).map((v)=>v.name).join(', ');
-        const count = version.packages.length;
-        if (count > 3) {
-            packageInfo += `...and ${count - 3} more`;
+        const pkgCount = version.packages.length;
+        if (pkgCount > 3) {
+            packageInfo += `...and ${pkgCount - 3} more`;
         }
-        if (count === 0) {
+        if (pkgCount === 0) {
             packageInfo = 'no package';
         } else {
             packageInfo = `[${packageInfo}]`;
@@ -91,7 +93,9 @@ const commands = {
             name: versionName,
             hash,
             description: description || await (0, _utils.question)('输入版本描述:'),
-            metaInfo: metaInfo || await (0, _utils.question)('输入自定义的 meta info:')
+            metaInfo: metaInfo || await (0, _utils.question)('输入自定义的 meta info:'),
+            deps: _depversions.depVersions,
+            commit: await (0, _git.getCommitInfo)()
         });
         // TODO local diff
         (0, _utils.saveToLocal)(fn, `${appId}/ppk/${id}.ppk`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-update-cli",
-  "version": "1.41.0",
+  "version": "1.42.1",
   "description": "Command tools for javaScript updater with `pushy` service for react native apps.",
   "main": "index.js",
   "bin": {
@@ -35,26 +35,27 @@
   },
   "homepage": "https://github.com/reactnativecn/react-native-pushy/tree/master/react-native-pushy-cli",
   "dependencies": {
-    "@badisi/latest-version": "^7.0.10",
+    "@badisi/latest-version": "^7.0.12",
     "bplist-parser": "^0.3.2",
     "bytebuffer": "^5.0.1",
     "cgbi-to-png": "^1.0.7",
     "chalk": "4",
     "cli-arguments": "^0.2.1",
-    "commander": "^12.1.0",
+    "commander": "^13.1.0",
     "compare-versions": "^6.1.1",
     "filesize-parser": "^1.5.1",
-    "form-data": "^4.0.1",
+    "form-data": "^4.0.2",
     "fs-extra": "8",
     "gradle-to-js": "^2.0.1",
-    "i18next": "^24.2.2",
+    "i18next": "^24.2.3",
+    "isomorphic-git": "^1.29.0",
     "isomorphic-unzip": "^1.1.5",
     "node-fetch": "^2.6.1",
     "plist": "^3.1.0",
     "progress": "^2.0.3",
     "properties": "^1.2.1",
-    "read": "^4.0.0",
-    "semver": "^7.6.3",
+    "read": "^4.1.0",
+    "semver": "^7.7.1",
     "tcp-ping": "^0.1.1",
     "tty-table": "4.2",
     "update-notifier": "^5.1.0",
@@ -66,11 +67,11 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^1.9.4",
-    "@swc/cli": "^0.5.1",
-    "@swc/core": "^1.9.3",
+    "@swc/cli": "^0.6.0",
+    "@swc/core": "^1.11.9",
     "@types/filesize-parser": "^1.5.3",
     "@types/fs-extra": "^11.0.4",
-    "@types/node": "^22.9.3",
+    "@types/node": "^22.13.10",
     "@types/node-fetch": "^2.6.12",
     "@types/progress": "^2.0.7",
     "@types/semver": "^7.5.8",
@@ -78,6 +79,6 @@
     "@types/update-notifier": "^6.0.8",
     "@types/yauzl": "^2.10.3",
     "@types/yazl": "^2.4.6",
-    "typescript": "^5.7.2"
+    "typescript": "^5.8.2"
   }
 }

package/src/api.ts

@@ -92,7 +92,7 @@ function queryWithoutBody(method: string) {
 }
 
 function queryWithBody(method: string) {
-  return (api: string, body: Record<string, any>) =>
+  return (api: string, body?: Record<string, any>) =>
     query(host + api, {
       method,
       headers: {

package/src/app.ts

@@ -72,20 +72,24 @@ export async function chooseApp(platform: Platform) {
 }
 
 export const commands = {
-  createApp: async function ({ options }) {
+  createApp: async function ({
+    options,
+  }: {
+    options: { name: string; downloadUrl: string; platform: Platform };
+  }) {
     const name = options.name || (await question('应用名称:'));
     const { downloadUrl } = options;
     const platform = checkPlatform(
       options.platform || (await question('平台(ios/android/harmony):')),
     );
-    const { id } = await post('/app/create', { name, platform });
+    const { id } = await post('/app/create', { name, platform, downloadUrl });
     console.log(`已成功创建应用（id: ${id}）`);
     await this.selectApp({
       args: [id],
-      options: { platform, downloadUrl },
+      options: { platform },
     });
   },
-  deleteApp: async ({ args, options }) => {
+  deleteApp: async ({ args, options }: { args: string[]; options: { platform: Platform } }) => {
     const { platform } = options;
     const id = args[0] || chooseApp(platform);
     if (!id) {
@@ -94,11 +98,11 @@ export const commands = {
     await doDelete(`/app/${id}`);
     console.log('操作成功');
   },
-  apps: async ({ options }) => {
+  apps: async ({ options }: { options: { platform: Platform } }) => {
     const { platform } = options;
     listApp(platform);
   },
-  selectApp: async ({ args, options }) => {
+  selectApp: async ({ args, options }: { args: string[]; options: { platform: Platform } }) => {
     const platform = checkPlatform(
       options.platform || (await question('平台(ios/android/harmony):')),
     );
@@ -106,7 +110,7 @@ export const commands = {
       ? Number.parseInt(args[0])
       : (await chooseApp(platform)).id;
 
-    let updateInfo = {};
+    let updateInfo: Partial<Record<Platform, { appId: number; appKey: string }>> = {};
     if (fs.existsSync('update.json')) {
       try {
         updateInfo = JSON.parse(fs.readFileSync('update.json', 'utf8'));

package/src/bundle.ts

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { getRNVersion, translateOptions } from './utils';
+import { translateOptions } from './utils';
 import * as fs from 'fs-extra';
 import { ZipFile } from 'yazl';
 import { open as openZipFile } from 'yauzl';
@@ -10,6 +10,7 @@ import semverSatisfies from 'semver/functions/satisfies';
 const g2js = require('gradle-to-js/lib/parser');
 import os from 'node:os';
 const properties = require('properties');
+import { depVersions } from './utils/dep-versions';
 
 let bsdiff;
 let hdiff;
@@ -82,11 +83,13 @@ async function runReactNativeBundleCommand({
         paths: [process.cwd()],
       });
       const expoCliVersion = JSON.parse(
-        fs.readFileSync(
-          require.resolve('@expo/cli/package.json', {
-            paths: [process.cwd()],
-          }),
-        ).toString(),
+        fs
+          .readFileSync(
+            require.resolve('@expo/cli/package.json', {
+              paths: [process.cwd()],
+            }),
+          )
+          .toString(),
       ).version;
       // expo cli 0.10.17 (expo 49) 开始支持 bundle:embed
       if (semverSatisfies(expoCliVersion, '>= 0.10.17')) {
@@ -99,13 +102,13 @@ async function runReactNativeBundleCommand({
 
   const getRnCli = () => {
     try {
-      // rn >= 0.75
-      cliPath = require.resolve('@react-native-community/cli/build/bin.js', {
+      // rn < 0.75
+      cliPath = require.resolve('react-native/local-cli/cli.js', {
         paths: [process.cwd()],
       });
     } catch (e) {
-      // rn < 0.75
-      cliPath = require.resolve('react-native/local-cli/cli.js', {
+      // rn >= 0.75
+      cliPath = require.resolve('@react-native-community/cli/build/bin.js', {
         paths: [process.cwd()],
       });
     }
@@ -175,19 +178,11 @@ async function runReactNativeBundleCommand({
       platform,
       '--reset-cache',
     ]);
-    
+
     if (cli.taro) {
-      reactNativeBundleArgs.push(...[
-        '--type',
-        'rn',
-      ])
+      reactNativeBundleArgs.push(...['--type', 'rn']);
     } else {
-      reactNativeBundleArgs.push(...[
-        '--dev',
-        dev,
-        '--entry-file',
-        entryFile,
-      ]) 
+      reactNativeBundleArgs.push(...['--dev', dev, '--entry-file', entryFile]);
     }
 
     if (sourcemapOutput) {
@@ -927,9 +922,7 @@ export const commands = {
       throw new Error('Platform must be specified.');
     }
 
-    const { version, major, minor } = getRNVersion();
-
-    console.log(`Bundling with react-native: ${version}`);
+    console.log(`Bundling with react-native: ${depVersions['react-native']}`);
 
     await runReactNativeBundleCommand({
       bundleName,

package/src/index.ts

@@ -4,24 +4,11 @@ import { loadSession } from './api';
 import updateNotifier from 'update-notifier';
 import { printVersionCommand } from './utils';
 import pkg from '../package.json';
-import i18next from 'i18next';
-import en from './locales/en';
-import zh from './locales/zh';
-import { IS_CRESC } from './utils/constants';
-
-i18next.init({
-  lng: IS_CRESC ? 'en' : 'zh',
-  // debug: process.env.NODE_ENV !== 'production',
-  resources: {
-    en,
-    zh,
-  },
-});
+import { t } from './utils/i18n';
 
 updateNotifier({ pkg }).notify({
   isGlobal: true,
-  message:
-    '建议运行 `{updateCommand}` 来更新命令行工具以获得功能、性能和安全性的持续改进',
+  message: t('updateNotifier'),
 });
 
 function printUsage() {
@@ -30,7 +17,7 @@ function printUsage() {
 
   console.log('Usage is under development now.');
   console.log(
-    'Visit `https://github.com/reactnativecn/react-native-pushy` for early document.',
+    'Visit `https://github.com/reactnativecn/react-native-update` for document.',
   );
   process.exit(1);
 }
@@ -58,7 +45,7 @@ async function run() {
     .then(() => commands[argv.command](argv))
     .catch((err) => {
       if (err.status === 401) {
-        console.log('尚未登录。\n请在项目目录中运行`pushy login`命令来登录');
+        console.log(t('loginFirst'));
         return;
       }
       console.error(err.stack);

package/src/locales/en.ts

@@ -1 +1,17 @@
-export default {};
+export default {
+  updateNotifier:
+    'Run `{updateCommand}` to update the CLI to get continuous improvements in features, performance, and security.',
+  loginFirst:
+    'Not logged in.\nPlease run `cresc login` in the project directory to login.',
+  lockNotFound:
+    'No lock file detected, which may cause inconsistent dependencies and hot-updating issues.',
+  multipleLocksFound:
+    'Multiple lock files detected ({lockFiles}), which may cause inconsistent dependencies and hot-updating issues.',
+  lockBestPractice: `
+Best practices for lock files:
+1. All members of the development team should use the same package manager to maintain a single lock file.
+2. Add the lock file to version control (but do not commit multiple lock files of different formats).
+3. Pay attention to changes in the lock file during code review.
+This can reduce the risk of inconsistent dependencies and supply chain attacks.
+`,
+};

package/src/locales/zh.ts

@@ -1 +1,16 @@
-export default {};
+export default {
+  updateNotifier:
+    '建议运行 `{updateCommand}` 来更新命令行工具以获得功能、性能和安全性的持续改进',
+  loginFirst: '尚未登录。\n请在项目目录中运行`pushy login`命令来登录',
+  lockNotFound:
+    '没有检测到任何 lock 文件，这可能导致依赖关系不一致而使热更异常。',
+  lockBestPractice: `
+关于 lock 文件的最佳实践：
+1. 开发团队中的所有成员应该使用相同的包管理器，维护同一份 lock 文件。
+2. 将 lock 文件添加到版本控制中（但不要同时提交多种不同格式的 lock 文件）。
+3. 代码审核时应关注 lock 文件的变化。
+这样可以最大限度避免因依赖关系不一致而导致的热更异常，也降低供应链攻击等安全隐患。
+`,
+  multipleLocksFound:
+    '检测到多种不同格式的锁文件({lockFiles})，这可能导致依赖关系不一致而使热更异常。',
+};

package/src/package.ts

@@ -5,6 +5,9 @@ import { checkPlatform, getSelectedApp } from './app';
 
 import { getApkInfo, getIpaInfo, getAppInfo } from './utils';
 import Table from 'tty-table';
+import { depVersions } from './utils/dep-versions';
+import { getCommitInfo } from './utils/git';
+import type { Platform } from 'types';
 
 export async function listPackage(appId: string) {
   const { data } = await get(`/app/${appId}/package/list?limit=1000`);
@@ -79,13 +82,15 @@ export const commands = {
       name: versionName,
       hash,
       buildTime,
+      deps: depVersions,
+      commit: await getCommitInfo(),
     });
     saveToLocal(fn, `${appId}/package/${id}.ipa`);
     console.log(
       `已成功上传ipa原生包（id: ${id}, version: ${versionName}, buildTime: ${buildTime}）`,
     );
   },
-  uploadApk: async ({ args }) => {
+  uploadApk: async ({ args }: { args: string[] }) => {
     const fn = args[0];
     if (!fn || !fn.endsWith('.apk')) {
       throw new Error('使用方法: pushy uploadApk apk后缀文件');
@@ -116,13 +121,15 @@ export const commands = {
       name: versionName,
       hash,
       buildTime,
+      deps: depVersions,
+      commit: await getCommitInfo(),
     });
     saveToLocal(fn, `${appId}/package/${id}.apk`);
     console.log(
       `已成功上传apk原生包（id: ${id}, version: ${versionName}, buildTime: ${buildTime}）`,
     );
   },
-  uploadApp: async ({ args }) => {
+  uploadApp: async ({ args }: { args: string[] }) => {
     const fn = args[0];
     if (!fn || !fn.endsWith('.app')) {
       throw new Error('使用方法: pushy uploadApp app后缀文件');
@@ -153,34 +160,36 @@ export const commands = {
       name: versionName,
       hash,
       buildTime,
+      deps: depVersions,
+      commit: await getCommitInfo(),
     });
     saveToLocal(fn, `${appId}/package/${id}.app`);
     console.log(
       `已成功上传app原生包（id: ${id}, version: ${versionName}, buildTime: ${buildTime}）`,
     );
   },
-  parseApp: async ({ args }) => {
+  parseApp: async ({ args }: { args: string[] }) => {
     const fn = args[0];
     if (!fn || !fn.endsWith('.app')) {
       throw new Error('使用方法: pushy parseApp app后缀文件');
     }
     console.log(await getAppInfo(fn));
   },
-  parseIpa: async ({ args }) => {
+  parseIpa: async ({ args }: { args: string[] }) => {
     const fn = args[0];
     if (!fn || !fn.endsWith('.ipa')) {
       throw new Error('使用方法: pushy parseIpa ipa后缀文件');
     }
     console.log(await getIpaInfo(fn));
   },
-  parseApk: async ({ args }) => {
+  parseApk: async ({ args }: { args: string[] }) => {
     const fn = args[0];
     if (!fn || !fn.endsWith('.apk')) {
       throw new Error('使用方法: pushy parseApk apk后缀文件');
     }
     console.log(await getApkInfo(fn));
   },
-  packages: async ({ options }) => {
+  packages: async ({ options }: { options: { platform: Platform } }) => {
     const platform = checkPlatform(
       options.platform || (await question('平台(ios/android/harmony):')),
     );

package/src/utils/app-info-parser/utils.js

@@ -30,7 +30,7 @@ function mapInfoResource (apkInfo, resourceMap) {
   iteratorObj(apkInfo)
   return apkInfo
   function iteratorObj (obj) {
-    for (var i in obj) {
+    for (const i in obj) {
       if (isArray(obj[i])) {
         iteratorArray(obj[i])
       } else if (isObject(obj[i])) {

package/src/utils/dep-versions.ts

@@ -0,0 +1,26 @@
+const currentPackage = require(`${process.cwd()}/package.json`);
+
+const depKeys = Object.keys(currentPackage.dependencies);
+const devDepKeys = Object.keys(currentPackage.devDependencies);
+const dedupedDeps = [...new Set([...depKeys, ...devDepKeys])];
+
+const _depVersions: Record<string, string> = {};
+
+for (const dep of dedupedDeps) {
+  try {
+    const packageJsonPath = require.resolve(`${dep}/package.json`, {
+      paths: [process.cwd()],
+    });
+    const version = require(packageJsonPath).version;
+    _depVersions[dep] = version;
+  } catch (e) {}
+}
+
+export const depVersions = Object.keys(_depVersions)
+  .sort() // Sort the keys alphabetically
+  .reduce((obj, key) => {
+    obj[key] = _depVersions[key]; // Rebuild the object with sorted keys
+    return obj;
+  }, {} as Record<string, string>);
+
+// console.log({ depVersions });

package/src/utils/git.ts

@@ -0,0 +1,50 @@
+import git from 'isomorphic-git';
+import fs from 'node:fs';
+import path from 'node:path';
+
+export interface CommitInfo {
+  hash: string;
+  message: string;
+  author: string;
+  timestamp: string;
+  origin: string;
+}
+
+function findGitRoot(dir = process.cwd()) {
+  const gitRoot = fs.readdirSync(dir).find((dir) => dir === '.git');
+  if (gitRoot) {
+    // console.log({ gitRoot });
+    return path.join(dir, gitRoot);
+  }
+  const parentDir = path.dirname(dir);
+  if (parentDir === dir) {
+    return null;
+  }
+  return findGitRoot(parentDir);
+}
+
+const gitRoot = findGitRoot();
+
+export async function getCommitInfo(): Promise<CommitInfo | undefined> {
+  if (!gitRoot) {
+    return;
+  }
+  try {
+    const remotes = await git.listRemotes({ fs, gitdir: gitRoot });
+    const origin =
+      remotes.find((remote) => remote.remote === 'origin') || remotes[0];
+    const { commit, oid } = (
+      await git.log({ fs, gitdir: gitRoot, depth: 1 })
+    )[0];
+    return {
+      hash: oid,
+      message: commit.message,
+      author: commit.author.name || commit.committer.name,
+      timestamp: String(commit.committer.timestamp),
+      origin: origin.url,
+    };
+  } catch (error) {
+    console.error(error);
+    return;
+  }
+}

package/src/utils/i18n.ts

@@ -0,0 +1,28 @@
+import i18next from 'i18next';
+import en from '../locales/en';
+import zh from '../locales/zh';
+import { IS_CRESC } from './constants';
+i18next.init({
+  lng: IS_CRESC ? 'en' : 'zh',
+  // debug: process.env.NODE_ENV !== 'production',
+  resources: {
+    en,
+    zh,
+  },
+});
+
+declare module 'i18next' {
+  // Extend CustomTypeOptions
+  interface CustomTypeOptions {
+    // custom namespace type, if you changed it
+    defaultNS: 'en';
+    // custom resources type
+    resources: {
+      en: typeof en;
+      zh: typeof zh;
+    };
+    // other
+  }
+}
+
+export const t = i18next.t;

package/src/utils/index.ts

@@ -10,6 +10,7 @@ import { checkPlugins } from './check-plugin';
 
 import { read } from 'read';
 import { tempDir } from './constants';
+import { depVersions } from './dep-versions';
 
 export async function question(query: string, password?: boolean) {
   if (NO_INTERACTIVE) {
@@ -38,26 +39,6 @@ export function translateOptions(options: Record<string, string>) {
   return ret;
 }
 
-export function getRNVersion() {
-  const version = JSON.parse(
-    fs
-      .readFileSync(
-        require.resolve('react-native/package.json', {
-          paths: [process.cwd()],
-        }),
-      )
-      .toString(),
-  ).version;
-
-  const [, major, minor] = /^(\d+)\.(\d+)\./.exec(version) || [];
-
-  return {
-    version,
-    major: Number(major),
-    minor: Number(minor),
-  };
-}
-
 export async function getApkInfo(fn: string) {
   const appInfoParser = new AppInfoParser(fn);
   const bundleFile = await appInfoParser.parser.getEntry(
@@ -177,7 +158,7 @@ export function saveToLocal(originPath: string, destName: string) {
 
 async function getLatestVersion(pkgNames: string[]) {
   return latestVersion(pkgNames, {
-    useCache: true,
+    // useCache: true,
     requestOptions: {
       timeout: 2000,
     },
@@ -198,21 +179,11 @@ export async function printVersionCommand() {
     `react-native-update-cli: ${pkg.version}${latestPushyCliVersion}`,
   );
   let pushyVersion = '';
-  try {
-    const PACKAGE_JSON_PATH = require.resolve(
-      'react-native-update/package.json',
-      {
-        paths: [process.cwd()],
-      },
-    );
-    pushyVersion = require(PACKAGE_JSON_PATH).version;
-    latestPushyVersion = latestPushyVersion
-      ? ` （最新：${chalk.green(latestPushyVersion)}）`
-      : '';
-    console.log(`react-native-update: ${pushyVersion}${latestPushyVersion}`);
-  } catch (e) {
-    console.log('react-native-update: 无法获取版本号，请在项目目录中运行命令');
-  }
+  pushyVersion = depVersions['react-native-update'];
+  latestPushyVersion = latestPushyVersion
+    ? ` （最新：${chalk.green(latestPushyVersion)}）`
+    : '';
+  console.log(`react-native-update: ${pushyVersion}${latestPushyVersion}`);
   if (pushyVersion) {
     if (semverSatisfies(pushyVersion, '<8.5.2')) {
       console.warn(
@@ -229,6 +200,8 @@ export async function printVersionCommand() {
         '当前版本已不再支持，请升级到 v10 的最新小版本（代码无需改动，可直接热更）: npm i react-native-update@10',
       );
     }
+  } else {
+    console.log('react-native-update: 无法获取版本号，请在项目目录中运行命令');
   }
 }
 

package/src/utils/lock-checker.ts

@@ -0,0 +1,7 @@
+const lockFiles = [
+  'package-lock.json',
+  'yarn.lock',
+  'pnpm-lock.yaml',
+  'bun.lockb',
+  'bun.lock',
+];

package/src/versions.ts

@@ -4,6 +4,8 @@ import { question, saveToLocal } from './utils';
 import { checkPlatform, getSelectedApp } from './app';
 import { choosePackage } from './package';
 import { compare } from 'compare-versions';
+import { depVersions } from './utils/dep-versions';
+import { getCommitInfo } from './utils/git';
 
 async function showVersion(appId: string, offset: number) {
   const { data, count } = await get(`/app/${appId}/version/list`);
@@ -13,11 +15,11 @@ async function showVersion(appId: string, offset: number) {
       .slice(0, 3)
       .map((v) => v.name)
       .join(', ');
-    const count = version.packages.length;
-    if (count > 3) {
-      packageInfo += `...and ${count - 3} more`;
+    const pkgCount = version.packages.length;
+    if (pkgCount > 3) {
+      packageInfo += `...and ${pkgCount - 3} more`;
     }
-    if (count === 0) {
+    if (pkgCount === 0) {
       packageInfo = 'no package';
     } else {
       packageInfo = `[${packageInfo}]`;
@@ -31,7 +33,7 @@ async function showVersion(appId: string, offset: number) {
   return data;
 }
 
-async function listVersions(appId) {
+async function listVersions(appId: string) {
   let offset = 0;
   while (true) {
     await showVersion(appId, offset);
@@ -52,7 +54,7 @@ async function listVersions(appId) {
   }
 }
 
-async function chooseVersion(appId) {
+async function chooseVersion(appId: string) {
   let offset = 0;
   while (true) {
     const data = await showVersion(appId, offset);
@@ -97,12 +99,15 @@ export const commands = {
 
     const { hash } = await uploadFile(fn);
 
-    const versionName = name || (await question('输入版本名称: ')) || '(未命名)';
+    const versionName =
+      name || (await question('输入版本名称: ')) || '(未命名)';
     const { id } = await post(`/app/${appId}/version/create`, {
       name: versionName,
       hash,
       description: description || (await question('输入版本描述:')),
       metaInfo: metaInfo || (await question('输入自定义的 meta info:')),
+      deps: depVersions,
+      commit: await getCommitInfo(),
     });
     // TODO local diff
     saveToLocal(fn, `${appId}/ppk/${id}.ppk`);