react-native-update 10.53.1 → 10.54.0

package/src/provider.tsx

@@ -343,13 +343,36 @@ export const UpdateProvider = ({
     if (!assertWeb()) {
       return;
     }
-    const { checkStrategy, autoMarkSuccess } = options;
+    const { checkStrategy, autoMarkSuccess, autoMarkSuccessDelayMs } = options;
     let markSuccessTimer: ReturnType<typeof setTimeout> | undefined;
     if (autoMarkSuccess) {
+      const delay =
+        typeof autoMarkSuccessDelayMs === 'number' &&
+        autoMarkSuccessDelayMs >= 0
+          ? autoMarkSuccessDelayMs
+          : 1000;
       markSuccessTimer = setTimeout(() => {
-        // Failures are reported and surfaced via the onError subscription.
-        Promise.resolve(markSuccess()).catch(noop);
-      }, 1000);
+        // The health check is read when the timer fires, not when it was
+        // armed, so a late setOptions still applies.
+        const { healthCheck } = options;
+        (async () => {
+          if (healthCheck) {
+            let healthy = false;
+            try {
+              healthy = (await healthCheck()) !== false;
+            } catch (e: any) {
+              log('healthCheck threw, not marking success:', e?.message || e);
+              return;
+            }
+            if (!healthy) {
+              log('healthCheck returned false, not marking success');
+              return;
+            }
+          }
+          // Failures are reported and surfaced via the onError subscription.
+          await markSuccess();
+        })().catch(noop);
+      }, delay);
     }
     if (checkStrategy === 'both' || checkStrategy === 'onAppResume') {
       stateListener.current = AppState.addEventListener(
@@ -396,30 +419,42 @@ export const UpdateProvider = ({
   const parseTestPayload = useCallback(
     (payload: UpdateTestPayload) => {
       if (payload?.type?.startsWith('__rnPushy')) {
+        if (options.testChannel === false) {
+          // Production builds may refuse scanned codes that would pull an
+          // arbitrary published version.
+          log('test channel disabled, ignoring payload', payload.type);
+          return false;
+        }
         if (payload.type === '__rnPushyVersionHash') {
-          // Wrap the logger only for the duration of this test check; wrapping
-          // on any other __rnPushy* payload would never be undone (the finally
-          // below is the only restore point).
-          const logger = options.logger || (() => {});
-          options.logger = ({ type, data }) => {
-            logger({ type, data });
-            Alert.alert(type, JSON.stringify(data));
-          };
           const toHash = payload.data;
+          if (typeof toHash !== 'string' || !toHash) {
+            log('test payload without a target hash ignored');
+            return false;
+          }
           sharedState.toHash = toHash;
+          // No global logger swap for the duration of the check (it leaked
+          // into concurrent checks): the tester gets one alert with the
+          // outcome instead of one per logged event.
           checkUpdate({ extra: { toHash } })
             .then(() => {
-              if (updateInfoRef.current?.upToDate) {
+              const info = updateInfoRef.current;
+              if (info?.upToDate) {
                 Alert.alert(
                   client.t('alert_info'),
                   client.t('alert_no_update_wait')
                 );
+              } else if (info?.update) {
+                Alert.alert(
+                  client.t('alert_info'),
+                  JSON.stringify({
+                    hash: info.hash,
+                    name: info.name,
+                    description: info.description,
+                  })
+                );
               }
             })
-            .catch(noop)
-            .finally(() => {
-              options.logger = logger;
-            });
+            .catch(noop);
         }
         return true;
       }

package/src/type.ts

@@ -162,6 +162,28 @@ export interface ClientOptions {
     | null;
   checkStrategy?: 'onAppStart' | 'onAppResume' | 'both' | null;
   autoMarkSuccess?: boolean;
+  /**
+   * Delay before the Provider marks the running update as successful when
+   * `autoMarkSuccess` is on. Default 1000ms. Apps whose critical modules load
+   * after the first frame (navigation, remote config) should raise it — a
+   * version that crashes 3s after mount would otherwise already be marked
+   * good and never rolled back. For full control use `autoMarkSuccess: false`
+   * and call `markSuccess()` once the app is really ready.
+   */
+  autoMarkSuccessDelayMs?: number;
+  /**
+   * Consulted when the auto-mark timer fires: return false (or throw) to
+   * skip marking this launch — the next launch's crash protection then still
+   * applies. Call `markSuccess()` yourself later once the app is healthy.
+   */
+  healthCheck?: () => boolean | Promise<boolean>;
+  /**
+   * Whether the Provider honours test-channel payloads (`parseTestQrCode`,
+   * `__rnPushyVersionHash` deep links / QR codes) that target a specific
+   * version hash. Default true. Set to false in production builds that must
+   * not let a scanned code pull an arbitrary published version.
+   */
+  testChannel?: boolean;
   dismissErrorAfter?: number;
   debug?: boolean;
   throwError?: boolean;

package/src/updateFlowCore.ts

@@ -172,22 +172,113 @@ export function buildCheckRequestBody({
   isDev,
   extra,
 }: CheckRequestInput): Record<string, any> {
+  // Caller extras are spread FIRST so they can add fields (channel, custom
+  // filters, the debug-channel toHash) but never override the SDK identity
+  // fields the server keys its decision on: a stray `packageVersion` or
+  // `hash` in extra would otherwise make the server hand out a package for
+  // the wrong binary.
   const body: Record<string, any> = {
+    ...extra,
     packageVersion,
     hash: currentVersion,
     buildTime,
     cInfo,
-    // 可消费的 diff 轨道版本(2 = hdiffv2 轨道),服务端据此门控下发
-    ...(supportedDiffVersion ? { diffV: supportedDiffVersion } : {}),
-    ...(bundleHash ? { bundleHash } : {}),
-    ...extra,
   };
+  // 可消费的 diff 轨道版本(2 = hdiffv2 轨道),服务端据此门控下发
+  if (supportedDiffVersion) {
+    body.diffV = supportedDiffVersion;
+  } else {
+    delete body.diffV;
+  }
+  if (bundleHash) {
+    body.bundleHash = bundleHash;
+  } else {
+    delete body.bundleHash;
+  }
   if (isDev) {
     delete body.buildTime;
   }
+  // Transitional dual form: the legacy root-level spread above is what
+  // servers before 2026-08-30 read; the nested copy is what new servers read
+  // first (extra.toHash wins there) and lets caller keys stop sharing the
+  // SDK's namespace once the root spread is retired.
+  if (extra) {
+    // Match JSON.stringify semantics: undefined values do not exist on the
+    // wire, so they must not create a nested copy either (the native check
+    // cache compares serialized requests).
+    const defined: Record<string, any> = {};
+    for (const [key, value] of Object.entries(extra)) {
+      if (value !== undefined) {
+        defined[key] = value;
+      }
+    }
+    if (Object.keys(defined).length > 0) {
+      body.extra = defined;
+    }
+  }
   return body;
 }
 
+export interface CheckFingerprintInput {
+  appKey?: string;
+  endpoints?: string[];
+  queryUrls?: string[];
+  uuid?: string;
+  /** The exact serialized request body (identity fields + extra). */
+  body: string;
+}
+
+/**
+ * Identity of one update check. Two checks may share an in-flight response
+ * only when every input that could change the server's answer is identical.
+ */
+export function buildCheckFingerprint({
+  appKey,
+  endpoints,
+  queryUrls,
+  uuid,
+  body,
+}: CheckFingerprintInput): string {
+  return JSON.stringify([
+    appKey ?? '',
+    endpoints ?? [],
+    queryUrls ?? [],
+    uuid ?? '',
+    body,
+  ]);
+}
+
+/**
+ * Whether a failed download attempt is worth retrying on another mirror of
+ * the same artifact. Transport failures (DNS, connect, timeout, truncated
+ * body, 5xx) and corrupt bytes are; a patch that downloaded fine but could
+ * not be applied is not — every mirror serves the same bytes, so the next
+ * strategy is the only way forward.
+ */
+export function isMirrorRetryableCode(code?: string): boolean {
+  return code !== 'PATCH_FAILED';
+}
+
+/**
+ * Schema gate for a checkUpdate response (mirrors C++ IsValidCheckResult): a
+ * JSON object carrying at least one verdict field of the expected type —
+ * `upToDate` / `update` / `expired` (boolean) or `paused` (string). A 200
+ * with `{"error": ...}`, an array or an HTML page that happened to parse is
+ * a failed endpoint, not a verdict, and must not stop the endpoint fallback.
+ */
+export function isValidCheckResult(value: unknown): value is CheckResult {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return false;
+  }
+  const root = value as Record<string, unknown>;
+  return (
+    typeof root.upToDate === 'boolean' ||
+    typeof root.update === 'boolean' ||
+    typeof root.expired === 'boolean' ||
+    typeof root.paused === 'string'
+  );
+}
+
 export interface UpdateIdentity {
   packageVersion: string;
   currentVersion?: string;

package/src/utils.ts

@@ -66,6 +66,13 @@ const ping = isWeb
           DEFAULT_FETCH_TIMEOUT_MS
         );
         if (status === 200) {
+          if (isProtocolDowngrade(url, finalUrl)) {
+            // The probe was redirected from https to plaintext http. Never
+            // let a downgraded final URL win the race: the winner is what
+            // the real artifact download uses.
+            log('ping rejected: https redirected to http', url, finalUrl);
+            throw Error(i18n.t('error_ping_failed'));
+          }
           return finalUrl;
         }
         log('ping failed', url, status, statusText);
@@ -166,29 +173,34 @@ export const fetchWithTimeout = (
     });
 };
 
-const isIdempotentRequest = (params: Parameters<typeof fetch>[1]) => {
-  const method = params?.method?.toUpperCase() ?? 'GET';
-  return method === 'GET' || method === 'HEAD';
-};
+/**
+ * True when `finalUrl` (after redirects) is plaintext http while the request
+ * started on https. An https endpoint or artifact URL must never be served
+ * over http, redirected or otherwise: the update package is the supply chain
+ * boundary, and TLS is the only thing authenticating it.
+ */
+export const isProtocolDowngrade = (
+  requestedUrl: string,
+  finalUrl?: string | null
+): boolean =>
+  !!finalUrl && /^https:/i.test(requestedUrl) && /^http:/i.test(finalUrl);
 
 export const enhancedFetch = async (
   url: string,
-  params: Parameters<typeof fetch>[1],
-  isRetry = false
+  params: Parameters<typeof fetch>[1]
 ): Promise<Response> => {
-  return fetch(url, params).catch((e) => {
+  // No https -> http retry here, ever. Earlier versions replayed failed
+  // idempotent https requests over plaintext http as a "network
+  // compatibility" fallback; that silently moved endpoint discovery and
+  // package downloads outside TLS. Self-hosted plaintext deployments must
+  // configure explicit http:// URLs instead.
+  const response = await fetch(url, params).catch((e) => {
     log('fetch error', url, e);
-    if (
-      isRetry ||
-      (params as any)?.signal?.aborted ||
-      !url.startsWith('https:') ||
-      // Never replay non-idempotent requests (e.g. the checkUpdate POST)
-      // over plaintext http: the server may have processed the original.
-      !isIdempotentRequest(params)
-    ) {
-      throw e;
-    }
-    log('trying fallback to http');
-    return enhancedFetch(url.replace(/^https:/, 'http:'), params, true);
+    throw e;
   });
+  if (isProtocolDowngrade(url, response?.url)) {
+    log('fetch rejected: https redirected to http', url, response.url);
+    throw Error(i18n.t('error_insecure_redirect'));
+  }
+  return response;
 };

package/.gitmodules

@@ -1,6 +0,0 @@
-[submodule "android/jni/lzma"]
-	path = android/jni/lzma
-	url = https://github.com/sisong/lzma.git
-[submodule "android/jni/HDiffPatch"]
-	path = android/jni/HDiffPatch
-	url = https://github.com/sisong/HDiffPatch.git