Skip to content

v10.54.0

Choose a tag to compare

View all tags
@sunnylqm sunnylqm released this 30 Aug 03:26
· 33 commits to master since this release
v10.54.0
9c6f73e
This commit was signed with the committer’s verified signature.
sunnylqm Sunny Luo
SSH Key Fingerprint: YvgEN//aCN45+tCn7lmXL72uTB0I4p154UAO3vb6zXA
Verified
Learn about vigilant mode.

English

Security hardening batch (CODE_AUDIT §13): blocks HTTPS→HTTP downgrade; uses a two-phase install with digest-bearing completion records; scopes check deduplication by fingerprint; supports multi-mirror download fallback; persists state transactionally; enforces archive resource limits and a strict check-response schema; and adds markJsCheckCompleted, the autoMarkSuccessDelayMs / healthCheck / testChannel options, getUpdateMetadata with Sentry and Crashlytics helpers, nested checkUpdate extra data, and currentBundleSha256. The Expo postinstall script was removed, and published package files are now constrained by a whitelist.

中文

本版本集中完成安全加固（CODE_AUDIT §13）：禁止 HTTPS→HTTP 降级；采用两阶段安装并在完成记录中携带摘要；按 fingerprint 隔离检查去重；支持多镜像下载回退；以事务方式持久化状态；限制归档资源用量并严格校验检查响应 schema；同时新增 markJsCheckCompleted、autoMarkSuccessDelayMs / healthCheck / testChannel 选项、getUpdateMetadata 及 Sentry/Crashlytics 辅助方法、嵌套的 checkUpdate extra 数据和 currentBundleSha256。此外移除了 Expo postinstall 脚本，并通过白名单限制 npm 包中发布的文件。

Assets 2
Loading