[4.1.1] - 2026-10-21​

Changed​

• Refreshed the supported Capacitor 8, CLI, build, lint and test dependencies without changing the public plugin API. TypeScript remains on the fleet-safe 6.0 line.
• Refreshed the bundled CLI's Chalk and Express dependencies and verified both ESM and CommonJS package entry points plus the installed CLI help path from the candidate tarball.

[4.1.0] - 2026-09-05​

Fixed​

• A locally-signed bundle can now actually be uploaded (ISSUE-08). builds.signature existed, the model exposed it and /v1/updates/check already served it — but no upload validation accepted a signature and neither store path set one from input. So native-update bundle sign produced a detached .sig that nothing could carry to the server, every build landed signature: null, and an app configured requireSignature: true rejected the download on device, indistinguishable from "no update arrived". POST /apps/{app}/builds now accepts an optional signature on both the dashboard and public planes, stores it, and serves it on the update-check.

Added​

• native-update deploy --signature <file>, and automatic pick-up of the sibling .sig that bundle sign writes — the documented local-signing flow now works end to end without a new flag to learn.
• bundle sign records bundleSha256 in its .sig, and deploy refuses to upload a signature whose checksum does not cover the bundle being sent. The server cannot detect that mismatch (it holds no public key to check against), so without this guard a stale .sig would publish a release every device rejects.

Notes​

• A caller-supplied signature wins over server-side signing and is never silently replaced — signing a consumer's bundle with the server key would produce a release that fails on device while every server-side check looked healthy.
• The server deliberately does not verify a caller-supplied signature: it never holds that public key. Verification happens on the device, against the key compiled into the binary, where it fails closed.

[4.0.0] - 2026-08-05​

Added​

• Real delta delivery. The canonical backend generates deterministic NUDELTA/1 copy/literal patches from the last three compatible active builds, stores only patches smaller than 85% of the full target archive, and advertises them on the existing update-check response. Web, Android, and iOS validate the patch checksum, source checksum, operation bounds, target size, and final target checksum; every failure falls back to the signed full bundle.
• Active GitHub Actions gates for the plugin, website, Laravel backend, Android, iOS, CLI, examples, dependency audits, publish-artifact inspection, and the no-source-map policy.
• Focused TypeScript delta tests and Laravel reconstruction/signed-download tests; the backend suite now contains 426 passing tests (1,253 assertions), alongside 83 Android plugin tests.

Changed​

• Requires Capacitor 8, Node.js 24.16+, Java 21, Android API 26+, Android compile/target SDK 36, Gradle 8.14.5, and current supported dependencies across every monorepo unit.
• Standardizes the wire and all verifiers on RSA-SHA256 (RSASSA-PKCS1-v1_5 with SHA-256), matching the backend signer. Removed false RSA-PSS/ECDSA fallback claims.
• Configuration is immutable after initialization. setUpdateUrl() remains a deprecated no-op; changing locked settings requires reset() followed by a new initialize()/configure() call.
• Android sensitive configuration now uses a non-exportable Android Keystore AES-256-GCM key rather than deprecated EncryptedSharedPreferences. iOS Keychain entries are device-only.
• Reveal endpoints for retrievable API/access-token secrets are POST-only, rate-limited, audited, and return no-store headers. Keystore replacement validates ZIP structure and uploads the new private object before deleting the old one.

Fixed​

• Native bridge return/argument shape drift, omitted iOS bridge methods, double-resolved initialization calls, nonfunctional background helper instances, fake worker responses, download cancellation tracking, boot-time signed-ZIP deletion, and inconsistent HTTPS/host/path checks.
• PayPal subscription plan changes now call the vendor-supported revise operation.
• The published examples and marketing snippets now use the real package name, v4 configuration shape, signed manifest fields, delta-aware download helper, and Capacitor 8 APIs.

Backend deploy required​

• Apply 2026_08_05_000001_create_delta_patches_table.php, rebuild Laravel caches, restart PHP-FPM when needed for OPcache, and verify /api/version returns 2026.08.05.1.

[3.4.0] - 2026-07-23​

Added​

• Full app lifecycle on the Public Management API. Beyond builds, the /api/public/v1 plane now creates, edits, and deletes apps; manages an app's API keys (list, create, rotate, reveal, restrict, revoke, deprecate, delete — the secret is only ever shown on create/rotate/reveal); manages its signing key (show public key + fingerprint, create, rotate — the private key never leaves the server); and stores a private keystore backup (upload and download a .zip up to 10 MB, held with private visibility and only ever streamed back through the API, never a public URL). CI or an agent can now provision and run an app end to end without the dashboard. Machine-readable spec: https://nativeupdate-docs.aoneahsan.com/openapi/public-api.json (now v1.1.0), with a front-matter-stripped Markdown mirror at /raw/*.md indexed by /raw/manifest.json.
• all_apps token scope. An access token can now cover every app you own — the ones you have and any created later — instead of a fixed ticked list. Creating an app with a specifically-scoped token auto-attaches the new app to it. GET /token reports all_apps.
• Two more opt-in delete permissions. Alongside builds.delete, a token can be granted apps.delete and keys.delete (both off by default). Deleting an app or a key without the matching permission answers 403 TOKEN_PERMISSION_DENIED. Access tokens themselves stay dashboard-only — nothing on the API can create, rotate, or delete one.
• Build controls: a mandatory flag on upload and edit; a BUILD_NOT_READY guard so a build cannot be forced active before its upload job completes; and rollout pause/resume via enabled, alongside the percentage (0 halts).
• New CLI commands for the whole surface: apps create|show|update|delete, apps keys list|create|show|rotate|reveal|revoke|deprecate|restrict|delete, apps signing show|create|rotate, and apps keystore upload|info|download|delete. Auth via NATIVE_UPDATE_TOKEN, as with deploy.

Backend​

• Requires a deploy: new public-plane controllers and routes for app CRUD, API-key management, signing keys, and the keystore backup; migrations for the keystore backup and the all_apps token flag; and a permissions seeder re-run for the new apps.delete and keys.delete permissions. 423 PHPUnit tests pass.