Cap-go/capacitor-updater 6.51.23

on GitHub

🆕 Changelog

Security

• Hardened manifest update parsing to reject path-traversal sequences, preventing files from being written outside the intended location.
• Restricted delete operations to paths within the updater sandbox so the plugin cannot remove unexpected files.
• Rejected invalid bundle identifiers such as . during update processing to block malformed or malicious packages.
• Enforced that manifest updates include a sessionKey whenever a publicKey is configured.

Fixed

• Fixed an Android null-pointer exception that could occur when AES decryption fails in CryptoCipher.decryptFile.
• Restored the example app to SDK 36 / AGP 8.13 LTS dependencies and regenerated bun.lock v1 for compatibility with the LTS bump.
• Pinned Vite 7 in the example app to resolve Maestro test harness settle issues.

Changed

• Restored Capacitor v6 dependency constraints after backporting changes.

🔗 Full Changelog: 6.51.21...6.51.23