Cap-go/capacitor-updater 5.51.23

on GitHub

🆕 Changelog

Changed

• Restored Capacitor v5 dependency constraints after integrating upstream backports.
• Backported upstream fixes onto the v5 maintenance branch.

Fixed

• Fixed an Android NullPointerException when AES file decryption fails so CryptoCipher.decryptFile reports the error gracefully instead of crashing.
• Restored and pinned the example app build dependencies (SDK 36 / AGP 8.13 and Vite 7) to keep the Maestro test harness stable.
• Fixed iOS logger initialization in delete sandbox tests to prevent flaky test runs.

Security

• Reject manifest updates that omit a sessionKey when a publicKey is configured, preventing incomplete encrypted updates.
• Reject path traversal sequences in manifest update payloads so files cannot be written outside the intended update directory.
• Constrained delete operations to paths inside the updater sandbox and rejected invalid bundle identifiers such as ..

🔗 Full Changelog: 5.51.21...5.51.23