Cap-go/capacitor-updater 7.51.23 on GitHub

🆕 Changelog

Enforce session-key requirements for encrypted manifest updates. Manifest updates now must include a sessionKey whenever a publicKey is configured. Updates missing this value are rejected, preventing unauthorized or partially configured payloads from being applied.
Block path traversal in manifest update payloads. Sequences such as ../ are now rejected, ensuring the updater can only write files inside its designated directory.
Constrain delete paths to the updater sandbox. Delete operations are restricted to paths within the updater sandbox, and the . bundle identifier is no longer accepted, reducing the risk of accidental or malicious deletions.

Fix Android crash on AES decryption failure. CryptoCipher.decryptFile now handles AES decryption failures gracefully instead of raising a NullPointerException.
Restore example-app build compatibility for the v7 LTS line. The example app build configuration is restored for SDK 36 / AGP 8.13, and the lockfile is reverted to bun.lock v1 to avoid tooling mismatches.
Stabilize example-app Maestro tests. Vite 7 is pinned in the example app to resolve test harness flakiness.

Backport upstream fixes to v7 LTS. Reliability and security improvements from releases 8.51.22 and 8.51.23 have been backported into this v7 line.
Restore Capacitor v7 dependency constraints. Dependency constraints are realigned with the v7 LTS release line after the upstream backports.

🔗 Full Changelog: 7.51.21...7.51.23