Skip to content

v0.7.0

Latest
Latest

Choose a tag to compare

View all tags
@GFean GFean released this 29 Aug 22:59
Immutable release. Only release title and notes can be modified.
v0.7.0
4af02c6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Native automatic recovery — before JavaScript starts

Bundle Drop 0.7.0 moves automatic launch-health tracking and crash-loop recovery into the native iOS and Android startup paths. A broken OTA can now be recovered even when React Native or application JavaScript never starts—for example, after an update references native code that is missing from the installed binary.

Highlights

  • Native crash-loop recovery: every OTA launch receives a unique native attempt ID. An unfinished attempt is counted only on the next distinct launch, retried up to rollback.maxCrashCount, then quarantined.
  • Guaranteed safe fallback: recovery restores only a native-proven healthy OTA. If none is eligible, Bundle Drop launches the bundle embedded in the app.
  • Automatic and manual health: automatic mode waits for React content and healthyAfterSec. Opt-in BundleDrop.reportHealthy() remains supported for apps with hydration, migrations, authentication, or other readiness checks. Stale callbacks cannot approve a newer launch.
  • Offline startup safety: native integrity, runtime identity, quarantine, and locally persisted revocation checks run without a launch-blocking network request.
  • Resilient persistence: the versioned recovery ledger and pointer transitions are atomic, interruption-safe, and fail closed to embedded code when state cannot be trusted.
  • Recovery telemetry preserved: quarantined crash-loop candidates continue through the existing rollback reporting contract.

Setup and migration improvements

  • The canonical committed trust bootstrap is now .bundle-drop/runtime-delivery.lock.json.
  • npx bundle-drop sync safely migrates the legacy runtime-delivery.generated.json file after validating the new lockfile.
  • Generated Metro configuration is ESLint-compatible.
  • Security-sensitive CLI command execution, authentication-origin handling, and artifact cleanup were hardened, with a reproducible local CodeQL gate.

Upgrade

nativeVersion is now 0.6.0, so this release requires a rebuilt iOS and Android binary; native recovery cannot be delivered to an older binary through OTA JavaScript alone.

npm install @gfean/react-native-bundle-drop@0.7.0
npx bundle-drop sync
npx bundle-drop doctor

Refresh CocoaPods or Expo prebuild as appropriate, then ship the rebuilt binary. Existing rollback configuration and the public reportHealthy() API remain compatible.

Compatibility and validation

Public compatibility remains React Native 0.71+ and Expo SDK 54–57, across legacy and New Architecture integrations. Recovery was exercised on real Android and iOS runtimes—including startup failures before JavaScript, retry thresholds, quarantine, verified previous recovery, embedded fallback, native process termination, and successful healthy updates afterward.

See PR #30 and the full comparison.

Assets 3
Loading