v10.48.1

Patch release from a full re-audit of the code added since v10.48.0 (hbc transform, error pipeline, resetToPackagedBundle, telemetry, CI). No API breaking changes; one new event type and one new error code are additive.

Fixes

• hbc transform: reject out-of-range bit fields from patch metadata (4ba62fb): a crafted/corrupted __diff.json could carry bit=0xFFFFFFFF, wrapping the range check and hitting shift-exponent UB during the v2-track transform. Both the transform and the wire parser now reject it; the wire parser gained a full negative-case test suite. Android .so rebuilt for all ABIs.
• Silent resetToPackagedBundle() no longer deletes the running version's files (50b1625): update assets (images/fonts) are read on demand from the version directory, so a no-restart reset broke every not-yet-loaded asset until the next cold start. All platforms now keep the running version's directory (cleaned up by the next regular cleanup). HarmonyOS additionally serializes the reset wipe with in-flight downloads/patches; iOS file work now uses one process-wide serial queue.
• Error pipeline gaps (6acefdd):
  • checkUpdate()'s 5s response cache path now honors throwError:false and always fires afterCheckUpdate, even when a concurrent in-flight check fails.
  • Native error codes (e.g. PATCH_FAILED) survive the download strategy loop instead of collapsing to DOWNLOAD_FAILED, so server-side patch-health classification works.
  • A throw from a user hook (beforeReload) gets the new USER_HOOK_ERROR code and is excluded from server-side patch-fail stats.
  • The provider now asks the client whether an error was already surfaced (wasEmitted) instead of guessing from e.code — axios/system errors thrown in user hooks are no longer silently swallowed.
• iOS download total-time cap raised 300s → 600s (0ab75e8) to match Android's 10-minute callTimeout: large full packages on slow networks failed only on iOS. Also fixes a HarmonyOS path where a write failure followed by a close failure left the download promise permanently pending.
• Low-severity sweep (10c5360): deterministic PATCH_FAILED classification for iOS unzip failures; no >100% progress on gzip-encoded downloads; Android progress contract (no duplicate final event, unknown total normalized to 0); restartApp() joins the error pipeline (new errorRestart event); malformed deep links no longer throw; HarmonyOS download watchdog no longer misfires during connection setup; and more (see commit).

CI / publishing hardening (repo-internal)

• The publish pipeline now fails loudly instead of silently shipping a broken package (8e6aec3): HAR backfill is fail-closed, the pinned NDK actually gets used (runner images preset ANDROID_NDK_HOME), committed binaries are removed before the CI-built artifact lands, prepublishOnly verifies the .so exports as a last gate, and the e2e-ios app cache is keyed on codegen inputs.

Full changelog: v10.48.0...v10.48.1