5.3.0

Minor Changes

• #1378 d806b04 Thanks @bartekkrok! - Add maxInlineSize option to assets loader for size-based asset inlining. Use it together with inline: true — assets whose largest variant is within the threshold are inlined as base64 URIs; larger assets are extracted as separate files.

• #1376 daad54d Thanks @whydidoo! - Allow customizing the native HTTP client used to download remote scripts: RemoteScriptLoader.okHttpClientFactory on Android and ScriptManager.urlSessionFactory on iOS (for SSL pinning, interceptors, custom headers, timeouts, etc.)

• #1381 997816e Thanks @bartekkrok! - Add publicKeyPath and nativeProjectPaths options to CodeSigningPlugin. When publicKeyPath is set, the plugin automatically embeds the public key into Info.plist (iOS) and strings.xml (Android) during compilation, removing the need for manual native file setup. The embedPublicKey utility is also exported for standalone use.

Patch Changes

• #1417 376c996 Thanks @dannyhw! - Prevent excessive regular-expression backtracking when validating per-script public keys.

• #1379 8ab3105 Thanks @JhohellsDL! - Fix CodeSigningPlugin signing assets at processAssets ANALYSE stage (2000) instead of assetEmitted, ensuring bundles are signed before plugins running at REPORT stage (5000) such as withZephyr() can capture and upload them

• #1382 ac3577b Thanks @MikitasK! - Add support for passing a per-script publicKey from ScriptManager resolvers so signed bundles can be verified with a runtime-provided public key instead of only the app-embedded RepackPublicKey

• #1409 742d575 Thanks @dannyhw! - Update dependencies to resolve reported security advisories.

  @callstack/repack-dev-server raises its minimum versions for @fastify/middie, fastify, http-proxy-middleware, launch-editor and ws. @callstack/repack raises image-size, and pins terser-webpack-plugin to 5.5.0: it no longer depends on the vulnerable serialize-javascript, and it is the last release before 5.6.0, which silently skips minification under Rspack and leaves production bundles unminified. All bumps stay within the existing major versions, so there are no API changes.

• #1380 856f1c1 Thanks @MikitasK! - Fix Android dev-server URLs on physical devices by preserving localhost instead of rewriting it to 10.0.2.2.

• Updated dependencies [742d575]:

  • @callstack/repack-dev-server@5.3.0