Skip to content

v0.6.0

Latest
Latest

Choose a tag to compare

View all tags
@GFean GFean released this 22 Aug 03:41
Immutable release. Only release title and notes can be modified.
v0.6.0
a63f394
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Managed Runtime Delivery and Safer Project Setup

This release makes managed runtime delivery the standard Bundle Drop path, strengthens native verification and download safety, and substantially improves automated and manual project setup.

Managed runtime delivery

  • Added signed, identity-bound runtime manifests and publisher authority leases.
  • Added local manifest resolution for public rollout decisions.
  • Private user-property targeting remains securely evaluated by the Bundle Drop resolver.
  • Added fresh artifact authorization before managed downloads and patch application.
  • Added revocation-aware rollback and safe native-bundle recovery.
  • Added bounded manifest and artifact downloads, signature verification, generation checks, and integrity validation.
  • Added privacy-safe runtime delivery diagnostic counters.

Simplified configuration

  • Added bundle-drop sync to generate or repair the public runtime trust bootstrap.
  • Runtime delivery no longer requires a public mode/version flag.
  • bundle.drop.config.js remains the project identity source and is safe to commit.
  • .bundle-drop/runtime-delivery.generated.json contains public verification material and should also be committed.
  • Deleting the generated bootstrap is recoverable by running bundle-drop sync.
  • Transient .bundle-drop/generated/* Metro files remain ignored and are recreated automatically.

Safer setup and migrations

  • Improved automatic Expo and bare React Native project detection.
  • Added strict startup-path validation for supported Android, Swift, and Objective-C React Native templates.
  • Improved CodePush and Expo Updates migration handling.
  • Native and dynamic Expo configuration patches remain review-only.
  • Added path, symlink, stale-hash, credential, and terminal-output protections.
  • Ambiguous or unsupported project structures fail safely to documented manual setup.
  • Expanded bundle-drop doctor validation and actionable diagnostics.
  • Added a complete no-AI manual setup flow.

Metro and Expo integration

  • Added package-managed Metro wrappers for bare React Native and Expo.
  • Preserves supported existing Metro configuration and export flow.
  • Improved Expo dynamic configuration preservation and plugin authority validation.
  • Added safer dependency migration and prebuild rollback handling.

Native runtime

  • Added native SHA-256 and ES256 verification support.
  • Added bounded native download handling on Android and iOS.
  • Strengthened native bundle selection, integrity checks, and rollback behavior.
  • Native package revision is now 0.5.0.

Upgrade instructions

  1. Upgrade @gfean/react-native-bundle-drop.

  2. If the package-managed Metro wrapper is not already installed, run:

    npx bundle-drop init

  3. Generate or repair the public runtime trust bootstrap:

    npx bundle-drop sync

  4. Commit .bundle-drop/runtime-delivery.generated.json with the project configuration.

  5. Refresh CocoaPods or Expo prebuild as appropriate and ship a new native binary for native package revision 0.5.0.

  6. Validate the completed setup:

    npx bundle-drop doctor

See PR #28 for the merged implementation.

Assets 3
Loading