react-native-update 10.55.0 → 10.56.0

package/ios/RCTPushy/RCTPushyDownloader.h

@@ -1,5 +1,19 @@
 #import <Foundation/Foundation.h>
 
+// Path of the resume sidecar that records what a partial download at
+// `savePath` belongs to (url + validators + total). Shared with the unzip
+// step, which must drop it together with the archive it vouches for.
+FOUNDATION_EXPORT NSString *RCTPushyResumeSidecarPath(NSString *savePath);
+
+// Size of the file at `path` in bytes; -1 when it cannot be read.
+FOUNDATION_EXPORT long long RCTPushyFileSize(NSString *path);
+
+// nil when the volume holding `path` can take `bytesToWrite` plus the
+// cpp/patch_core/archive_limits.h safety margin (or the free space is
+// unknown); the reason otherwise. `path` need not exist yet — the check walks
+// up to an existing ancestor.
+FOUNDATION_EXPORT NSString *RCTPushyFreeSpaceShortfall(NSString *path, long long bytesToWrite);
+
 @interface RCTPushyDownloader : NSObject
 
 + (void)download:(NSString *)downloadPath savePath:(NSString *)savePath

package/ios/RCTPushy/RCTPushyDownloader.mm

@@ -1,16 +1,17 @@
 #import "RCTPushyDownloader.h"
+#include "../../cpp/patch_core/archive_limits.h"
 
 static NSString *const RCTPushyDownloaderErrorDomain = @"cn.reactnative.pushy";
 
-// Cross-launch resumable download (NATIVE_CHECKUPDATE_DESIGN §11.4): the
-// archive streams straight into savePath (an NSURLSessionDownloadTask's
+// Cross-launch resumable download (NATIVE_CHECKUPDATE_DESIGN §11.4): a data
+// task streams the archive straight into savePath (a download task's
 // temporary file is discarded on failure, which made every partial byte
 // worthless), and a sidecar next to it records what the partial belongs to
 // (url + validators + total). A brick gets a few hundred milliseconds per
 // launch plus a bounded crash-rescue window, so progress must be monotonic
 // across process deaths.
 
-static NSString *RCTPushyResumeSidecarPath(NSString *savePath) {
+NSString *RCTPushyResumeSidecarPath(NSString *savePath) {
     return [savePath stringByAppendingString:@".resume"];
 }
 
@@ -35,15 +36,44 @@ static void RCTPushyDeleteResumeSidecar(NSString *savePath) {
                                                error:nil];
 }
 
-static long long RCTPushyFileSize(NSString *path) {
+long long RCTPushyFileSize(NSString *path) {
     NSDictionary *attributes =
         [[NSFileManager defaultManager] attributesOfItemAtPath:path error:nil];
     NSNumber *size = attributes[NSFileSize];
     return size == nil ? -1 : size.longLongValue;
 }
 
+// Free space on the volume holding `path` (walks up to an existing ancestor);
+// -1 when unknown.
+static long long RCTPushyFreeDiskSpaceForPath(NSString *path) {
+    NSFileManager *fileManager = [NSFileManager defaultManager];
+    NSString *probe = path;
+    while (probe.length > 1 && ![fileManager fileExistsAtPath:probe]) {
+        probe = [probe stringByDeletingLastPathComponent];
+    }
+    NSDictionary *attributes = [fileManager attributesOfFileSystemForPath:probe error:nil];
+    NSNumber *free = attributes[NSFileSystemFreeSize];
+    return free == nil ? -1 : free.longLongValue;
+}
+
+NSString *RCTPushyFreeSpaceShortfall(NSString *path, long long bytesToWrite) {
+    long long free = RCTPushyFreeDiskSpaceForPath(path);
+    if (free < 0) {
+        return nil;
+    }
+    long long needed = MAX(0LL, bytesToWrite) + pushy::archive_limits::kFreeDiskMarginBytes;
+    if (free < needed) {
+        return [NSString stringWithFormat:@"insufficient disk space: need %lld bytes, have %lld",
+                needed, free];
+    }
+    return nil;
+}
+
 // "bytes <start>-<end>/<total>". Returns the total (0 when "*"), or -1 when
-// missing/malformed or the start does not match the local partial.
+// missing/malformed, the start does not match the local partial, or the
+// range and total contradict each other (end before start, or a numeric
+// total not beyond the end — RFC 9110 §14.4). A total of 0 would otherwise
+// pass as "unknown" and skip the final size check.
 static long long RCTPushyParseContentRange(NSString *header, long long expectedStart) {
     if (![header hasPrefix:@"bytes "]) {
         return -1;
@@ -56,16 +86,35 @@ static long long RCTPushyParseContentRange(NSString *header, long long expectedS
         || dash.location > slash.location) {
         return -1;
     }
-    long long start = [range substringToIndex:dash.location].longLongValue;
-    if (start != expectedStart) {
+    NSCharacterSet *whitespace = [NSCharacterSet whitespaceCharacterSet];
+    NSString *startPart = [[range substringToIndex:dash.location]
+        stringByTrimmingCharactersInSet:whitespace];
+    NSString *endPart = [[range substringWithRange:
+        NSMakeRange(dash.location + 1, slash.location - dash.location - 1)]
+        stringByTrimmingCharactersInSet:whitespace];
+    NSString *totalPart = [[range substringFromIndex:slash.location + 1]
+        stringByTrimmingCharactersInSet:whitespace];
+    // longLongValue reads 0 for non-numeric text; require real digits.
+    NSCharacterSet *digits = [NSCharacterSet decimalDigitCharacterSet];
+    if (startPart.length == 0 || endPart.length == 0
+        || [startPart rangeOfCharacterFromSet:digits.invertedSet].location != NSNotFound
+        || [endPart rangeOfCharacterFromSet:digits.invertedSet].location != NSNotFound) {
+        return -1;
+    }
+    long long start = startPart.longLongValue;
+    long long end = endPart.longLongValue;
+    if (start != expectedStart || end < start) {
         return -1;
     }
-    NSString *totalPart = [range substringFromIndex:slash.location + 1];
     if ([totalPart isEqualToString:@"*"]) {
         return 0;
     }
+    if (totalPart.length == 0
+        || [totalPart rangeOfCharacterFromSet:digits.invertedSet].location != NSNotFound) {
+        return -1;
+    }
     long long total = totalPart.longLongValue;
-    return total > 0 ? total : -1;
+    return total > end ? total : -1;
 }
 
 @interface RCTPushyDownloader()<NSURLSessionDataDelegate>
@@ -90,8 +139,15 @@ static long long RCTPushyParseContentRange(NSString *header, long long expectedS
 // NSURLSession delivers decoded bytes, so length accounting against the
 // encoded Content-Length is meaningless and resume offsets cannot be trusted.
 @property (nonatomic, assign) BOOL encodedBody;
+// The archive was rejected outright (over archive_limits::kMaxArchiveBytes):
+// nothing on disk is worth resuming, so completion drops the partial and its
+// sidecar instead of leaving them as resume state.
+@property (nonatomic, assign) BOOL discardPartial;
 @property (nonatomic, assign) int lastReportedPercentage;
 @property (nonatomic, assign) long long lastReportedBytes;
+// receivedBytes up to which free disk has been probed for (unknown-length
+// bodies; 0 = probe before the first write)
+@property (nonatomic, assign) long long freeSpaceReservedUntil;
 @end
 
 @implementation RCTPushyDownloader
@@ -221,6 +277,10 @@ completionHandler:(void (^)(NSString *path, NSError *error))completionHandler
         }
         self.fileHandle = nil;
     }
+    if (self.discardPartial) {
+        [[NSFileManager defaultManager] removeItemAtPath:self.savePath error:nil];
+        RCTPushyDeleteResumeSidecar(self.savePath);
+    }
 
     void (^completionHandler)(NSString *, NSError *) = self.completionHandler;
     self.progressHandler = nil;
@@ -375,12 +435,44 @@ didReceiveResponse:(NSURLResponse *)response
         self.expectedTotal = self.contentLength > 0 ? self.contentLength : 0;
     }
 
+    // Caps from archive_limits.h, applied before the first body byte lands
+    // (Android does the same): the announced size up front here, streamed
+    // bytes in didReceiveData as the backstop for unknown/chunked lengths.
+    long long announcedTotal = self.expectedTotal;
+    if (announcedTotal <= 0 && !self.encodedBody && self.contentLength > 0) {
+        // A 206 whose Content-Range total is "*" still announces this body.
+        announcedTotal = self.baseOffset + self.contentLength;
+    }
+    if (announcedTotal > pushy::archive_limits::kMaxArchiveBytes) {
+        [self failWithDescription:[NSString stringWithFormat:@"archive too large: %lld bytes",
+                                   announcedTotal]
+                             code:-1];
+        self.discardPartial = YES;
+        completionHandler(NSURLSessionResponseCancel);
+        [self completeWithError:self.fileError];
+        return;
+    }
     NSFileManager *fileManager = [NSFileManager defaultManager];
     if (!append) {
-        // The server ignored the range (or none was sent): start over.
+        // The server ignored the range (or none was sent): the stale partial
+        // is dead weight either way, so free it before the space check
+        // counts it against this download (a full restart must not fail
+        // forever on space the partial itself is holding).
         [fileManager removeItemAtPath:self.savePath error:nil];
+    }
+    NSString *shortfall = RCTPushyFreeSpaceShortfall(
+        self.savePath, announcedTotal > 0 ? announcedTotal - self.baseOffset : 0);
+    if (shortfall != nil) {
+        // A resumable partial stays: a later attempt may find the space.
+        [self failWithDescription:shortfall code:-1];
+        completionHandler(NSURLSessionResponseCancel);
+        [self completeWithError:self.fileError];
+        return;
+    }
+    if (!append) {
         [fileManager createFileAtPath:self.savePath contents:nil attributes:nil];
     }
+    self.freeSpaceReservedUntil = 0;
     self.fileHandle = [NSFileHandle fileHandleForWritingAtPath:self.savePath];
     if (self.fileHandle == nil) {
         [self failWithDescription:@"cannot open download file for writing" code:-1];
@@ -418,6 +510,38 @@ didReceiveResponse:(NSURLResponse *)response
     if (self.fileHandle == nil || self.fileError != nil) {
         return;
     }
+    if (self.baseOffset + self.receivedBytes + (long long)data.length
+        > pushy::archive_limits::kMaxArchiveBytes) {
+        // Unknown/chunked length backstop; an announced size was already
+        // checked in didReceiveResponse. Checked before the write so the
+        // file on disk never exceeds the cap.
+        [self failWithDescription:[NSString stringWithFormat:
+            @"archive too large: exceeded %lld bytes",
+            pushy::archive_limits::kMaxArchiveBytes]
+                             code:-1];
+        self.discardPartial = YES;
+        [dataTask cancel];
+        return;
+    }
+    if (self.expectedTotal <= 0
+        && self.receivedBytes + (long long)data.length > self.freeSpaceReservedUntil) {
+        // Unknown/encoded length: the response-time check could only
+        // reserve the margin, so probe before any write that would run past
+        // the bytes reserved so far, each probe reserving at least the next
+        // PROBE bytes (more when one callback carries a larger buffer) — no
+        // write can ever eat into the margin. The archive cap alone (512
+        // MiB) is far more than the margin protects. The partial stays: a
+        // later attempt may find the space.
+        long long reserve = MAX(pushy::archive_limits::kUnknownLengthFreeSpaceProbeBytes,
+                                (long long)data.length);
+        self.freeSpaceReservedUntil = self.receivedBytes + reserve;
+        NSString *shortfall = RCTPushyFreeSpaceShortfall(self.savePath, reserve);
+        if (shortfall != nil) {
+            [self failWithDescription:shortfall code:-1];
+            [dataTask cancel];
+            return;
+        }
+    }
     @try {
         [self.fileHandle writeData:data];
     } @catch (NSException *exception) {
@@ -488,7 +612,8 @@ didCompleteWithError:(NSError *)error
         }
     }
     // On failure the partial + sidecar stay on disk — that is the resume
-    // state a later launch (or crash-rescue window) picks up.
+    // state a later launch (or crash-rescue window) picks up — unless the
+    // archive was rejected outright (discardPartial).
     [self completeWithError:finalError];
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-update",
-  "version": "10.55.0",
+  "version": "10.56.0",
   "description": "react-native hot update",
   "main": "src/index",
   "types": "src/index.ts",
@@ -8,6 +8,7 @@
     "src",
     "!src/__tests__",
     "android/src",
+    "!android/src/test",
     "android/lib",
     "android/jni",
     "!android/jni/HDiffPatch/test",
@@ -32,7 +33,7 @@
     "prepublishOnly": "NODE_ENV=production bun scripts/prepublish.ts",
     "publish:local": "SKIP_NATIVE_BUILD=1 npm publish",
     "prepack": "bun submodule && bun lint",
-    "lint": "biome check src && tsc --noEmit && node scripts/check-harmony-types.js",
+    "lint": "biome check src && tsc --noEmit && node scripts/check-harmony-types.js && node scripts/check-native-spec-parity.js",
     "lint:harmony": "node scripts/check-harmony-types.js",
     "submodule": "git submodule update --init --recursive",
     "test": "bun test src/__tests__",
@@ -42,21 +43,17 @@
     "build:harmony-har": "node scripts/build-harmony-har.js",
     "build:harmony-e2e": "bash Example/e2etest/scripts/build-harmony-e2e.sh",
     "build:so": "bun submodule && bash scripts/build-android-so.sh",
-    "build:ios-debug": "cd Example/e2etest && bun && detox build --configuration ios.sim.debug",
-    "build:ios-release": "cd Example/e2etest && bun && detox build --configuration ios.sim.release",
-    "test:ios-debug": "cd Example/e2etest && E2E_PLATFORM=ios detox test --configuration ios.sim.debug",
-    "test:ios-release": "cd Example/e2etest && E2E_PLATFORM=ios bun detox test --configuration ios.sim.release",
-    "build:android-debug": "cd Example/e2etest && bun && detox build --configuration android.emu.debug",
-    "build:android-release": "cd Example/e2etest && bun && detox build --configuration android.emu.release",
-    "test:android-release": "cd Example/e2etest && E2E_PLATFORM=android bun detox test --configuration android.emu.release --headless --record-logs all",
-    "test:android-debug": "cd Example/e2etest && E2E_PLATFORM=android detox test --configuration android.emu.debug --headless --record-logs all",
-    "smoke:android-debug": "cd Example/e2etest && detox test --configuration android.emu.debug --config e2e/smoke/jest.config.js",
+    "build:ios-debug": "cd Example/e2etest && bun && bunx detox build --configuration ios.sim.debug",
+    "build:ios-release": "cd Example/e2etest && bun && bunx detox build --configuration ios.sim.release",
+    "test:ios-debug": "cd Example/e2etest && E2E_PLATFORM=ios bunx detox test --configuration ios.sim.debug",
+    "test:ios-release": "cd Example/e2etest && E2E_PLATFORM=ios bunx detox test --configuration ios.sim.release",
+    "build:android-debug": "cd Example/e2etest && bun && bunx detox build --configuration android.emu.debug",
+    "build:android-release": "cd Example/e2etest && bun && bunx detox build --configuration android.emu.release",
+    "test:android-release": "cd Example/e2etest && E2E_PLATFORM=android bunx detox test --configuration android.emu.release --headless --record-logs all",
+    "test:android-debug": "cd Example/e2etest && E2E_PLATFORM=android bunx detox test --configuration android.emu.debug --headless --record-logs all",
+    "smoke:android-debug": "cd Example/e2etest && bunx detox test --configuration android.emu.debug --config e2e/smoke/jest.config.js",
     "e2e:ios": "bun build:ios-release && bun test:ios-release",
-    "e2e:android": "bun build:android-release && bun test:android-release",
-    "tests:emulator:prepare": "cd .github/workflows/scripts/functions && bun && bun build",
-    "tests:emulator:start-ci": "bun tests:emulator:prepare && cd ./.github/workflows/scripts && ./start-firebase-emulator.sh",
-    "tests:packager:jet-ci": "cd Example/e2etest && cross-env TMPDIR=$HOME/.metro REACT_DEBUGGER=\"echo nope\" node_modules/.bin/react-native start --no-interactive",
-    "tests:ios:pod:install": "cd Example/e2etest && bun && bun pod-install"
+    "e2e:android": "bun build:android-release && bun test:android-release"
   },
   "repository": {
     "type": "git",
@@ -79,8 +76,7 @@
   },
   "homepage": "https://github.com/reactnativecn/react-native-update#readme",
   "dependencies": {
-    "nanoid": "^3.3.3",
-    "react-native-url-polyfill": "^3.0.0"
+    "nanoid": "^3.3.3"
   },
   "codegenConfig": {
     "name": "RCTPushySpec",
@@ -93,18 +89,12 @@
     "@react-native/babel-preset": "^0.73.21",
     "@react-native/typescript-config": "0.84.1",
     "@types/bun": "^1.3.11",
-    "@types/jest": "^30.0.0",
     "@types/node": "^25.5.0",
     "@types/react": "^19.2.14",
     "@types/react-test-renderer": "18.0.7",
-    "detox": "^20.50.1",
-    "firebase-tools": "^15.11.0",
-    "jest": "^30.3.0",
-    "pod-install": "^1.0.14",
     "react": "18.2.0",
     "react-native": "0.73",
     "react-test-renderer": "18.2.0",
-    "ts-jest": "^29.4.6",
     "typescript": "^7.0.2"
   }
 }

package/react-native-update.podspec

@@ -91,16 +91,49 @@ Pod::Spec.new do |s|
   s.source = { :git => 'https://github.com/reactnativecn/react-native-update.git', :tag => "#{s.version}" }
 
   s.libraries = 'bz2', 'z'
+  # No search path into the pod source: every include under ios/ resolves
+  # relative to the including file (the cpp/ core via ../../cpp/...), and the
+  # former absolute "#{podspec_dir}/ios" entry made the generated xcconfig
+  # machine-specific.
   s.pod_target_xcconfig = { 
-    'USER_HEADER_SEARCH_PATHS' => "#{podspec_dir}/ios \"$(PODS_ROOT)/Headers/Public/SSZipArchive\" \"$(PODS_ROOT)/Headers/Public/React-Codegen/RCTPushySpec\"", 
+    'USER_HEADER_SEARCH_PATHS' => "\"$(PODS_ROOT)/Headers/Public/SSZipArchive\" \"$(PODS_ROOT)/Headers/Public/React-Codegen/RCTPushySpec\"", 
     "DEFINES_MODULE" => "YES" 
   }
+  # buildTime for binary-rebuild detection (SyncBinaryVersion) and the check
+  # request. The stamp is refreshed on every build and ships as a resource.
+  # When the pod source is not writable (read-only checkout or cache) the
+  # committed value is kept; +buildTime falls back to the main bundle's
+  # Info.plist mtime when the file is missing or empty, so it is never blank.
   s.resource = 'ios/pushy_build_time.txt'
-  s.script_phase = { :name => 'Generate build time', :script => "set -x;date +%s > \"#{podspec_dir}/ios/pushy_build_time.txt\"", :execution_position => :before_compile }
+  build_time_phase = {
+    :name => 'Generate build time',
+    :script => "set -x; f=\"${PODS_TARGET_SRCROOT:-#{podspec_dir}}/ios/pushy_build_time.txt\"; if [ -w \"$f\" ] || { [ ! -e \"$f\" ] && [ -w \"$(dirname \"$f\")\" ]; }; then date +%s > \"$f\"; else echo \"warning: $f is not writable, keeping the shipped build time\"; fi",
+    :execution_position => :before_compile
+  }
+  # Declaring the output lets Xcode order the resource copy (into the app, or
+  # into this pod's framework under use_frameworks!) after the stamp is
+  # written and stops the output-less-phase warning. A phase with outputs and
+  # no inputs is otherwise skipped once the file exists — and it is committed
+  # — so the phase must also be marked always out of date to keep refreshing
+  # the stamp every build. CocoaPods < 1.11 has no such key; there the phase
+  # stays output-less (runs every build, as before).
+  if defined?(Pod::Specification::DSL::SCRIPT_PHASE_OPTIONAL_KEYS) &&
+     Pod::Specification::DSL::SCRIPT_PHASE_OPTIONAL_KEYS.include?(:always_out_of_date)
+    build_time_phase[:output_files] = ['$(PODS_TARGET_SRCROOT)/ios/pushy_build_time.txt']
+    build_time_phase[:always_out_of_date] = '1'
+  end
+  s.script_phase = build_time_phase
+  # Privacy manifest (required-reason APIs: disk space, file timestamps,
+  # system boot time, user defaults) delivered as its own resource bundle so
+  # static and dynamic integrations both carry it.
+  s.resource_bundles = { 'react-native-update_privacy' => ['ios/PrivacyInfo.xcprivacy'] }
 
   s.dependency 'React'
   s.dependency "React-Core"
-  s.dependency 'SSZipArchive'
+  # The unzip guard relies on the 2.x delegate contract
+  # (zipArchiveShouldUnzipFileAtIndex:... cancels, _sanitizedPath); a future
+  # major could change it silently.
+  s.dependency 'SSZipArchive', '~> 2.4'
 
   # Conditionally add Expo dependency
   if valid_expo_project