Socket
Book a DemoInstallSign in
Socket

native-update

Package Overview
Dependencies
Maintainers
1
Versions
15
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

native-update

Foundation package for building a comprehensive update system for Capacitor apps. Provides architecture and interfaces but requires backend implementation.

1.1.4
latest
Source
npmnpm
Version published
Weekly downloads
40
-14.89%
Maintainers
1
Weekly downloads
 
Created
Source

Capacitor Native Update Plugin

⚠️ IMPORTANT: Production-Ready with Complete Examples ⚠️

This package is now feature-complete with significant improvements:

  • Production Backend Example Included - Full server implementation in production-backend/
  • Complete Example App - React + Firebase Functions in example-app/
  • Native Implementations Complete - iOS (Swift) and Android (Kotlin) fully implemented
  • Comprehensive Test Suite - Unit and integration tests with Vitest
  • Development Tools Included - Bundle creator, signer, and CLI tools
  • Security Features Implemented - HTTPS enforcement, signatures, checksums

🚀 Try the complete example app in example-app/ to see all features in action!

📚 Documentation

Getting Started

  • Installation Guide - Step-by-step installation instructions
  • Quick Start Guide - Get up and running in minutes
  • Configuration Guide - Detailed configuration options

Features Documentation

Guides & Best Practices

API Reference

Examples

A foundation package for building a comprehensive update management plugin for Capacitor that combines Live/OTA updates, native app store updates, and in-app review capabilities. This package provides the architecture, interfaces, and documentation but requires additional implementation work.

Features

🚀 Live Updates (OTA)

Deploy JavaScript, HTML, and CSS updates instantly without going through app store approval:

  • Multiple update strategies: Immediate, background, or manual updates
  • Delta updates: Only download changed files for faster updates
  • Automatic rollback: Revert to previous version if update fails
  • Update channels: Support for production, staging, and development environments
  • Security: End-to-end encryption and signature verification

📱 Native App Updates

Seamlessly manage app store updates with native UI integration:

  • Version checking: Detect when newer versions are available
  • Flexible updates: Background download with user-controlled installation
  • Immediate updates: Force critical updates with blocking UI
  • Platform integration: Google Play Core (Android) and App Store (iOS) support

⭐ App Reviews

Increase user engagement with intelligent review prompts:

  • In-app reviews: Native review dialogs without leaving the app
  • Smart triggering: Request reviews at optimal moments
  • Rate limiting: Respect platform limits (iOS: 3x/year)
  • Analytics: Track review request performance

Installation

npm install native-update
npx cap sync

Quick Start

1. Basic Setup

import { NativeUpdate } from 'native-update';

// Initialize on app start
async function initializeApp() {
  // Configure the plugin
  await NativeUpdate.configure({
    updateUrl: 'https://updates.yourdomain.com/api/v1',
    autoCheck: true,
    publicKey: 'your-public-key-for-security',
  });
}

2. Live Updates (OTA)

// Check and apply live updates
async function checkLiveUpdates() {
  try {
    const result = await NativeUpdate.sync();

    if (result.status === 'UPDATE_AVAILABLE') {
      // Download update with progress tracking
      const listener = NativeUpdate.addListener('downloadProgress', (progress) => {
        console.log(`Downloading: ${progress.percent}%`);
      });

      // Download the update
      const bundle = await NativeUpdate.download({
        url: result.url,
        version: result.version,
        checksum: result.checksum
      });

      // Set the bundle and reload
      await NativeUpdate.set(bundle);
      await NativeUpdate.reload();
      
      listener.remove();
    }
  } catch (error) {
    console.error('Update failed:', error);
  }
}

3. Native App Updates

// Check for app store updates
async function checkNativeUpdates() {
  const result = await NativeUpdate.getAppUpdateInfo();

  if (result.updateAvailable) {
    if (result.immediateUpdateAllowed) {
      // Critical update - must install
      await NativeUpdate.startImmediateUpdate();
    } else if (result.flexibleUpdateAllowed) {
      // Optional update - download in background
      await NativeUpdate.startFlexibleUpdate();
    }
  }
}

4. App Reviews

// Request app review at the right moment
async function requestAppReview() {
  // Only ask after positive interactions
  const shouldAsk = await checkIfGoodMoment();

  if (shouldAsk) {
    const result = await NativeUpdate.requestReview();
    if (result.displayed) {
      console.log('Review prompt was shown');
    }
  }
}

Real-World Example

import { Component, OnInit } from '@angular/core';
import { NativeUpdate } from 'native-update';
import { AlertController } from '@ionic/angular';

@Component({
  selector: 'app-root',
  templateUrl: 'app.component.html',
})
export class AppComponent implements OnInit {
  constructor(private alertCtrl: AlertController) {}

  async ngOnInit() {
    // Check for updates on app start
    await this.checkAllUpdates();

    // Set up periodic checks
    setInterval(() => this.checkAllUpdates(), 3600000); // Every hour
  }

  async checkAllUpdates() {
    // 1. Check live updates first (fastest)
    const liveUpdate = await NativeUpdate.sync();
    if (liveUpdate.status === 'UPDATE_AVAILABLE' || liveUpdate.status === 'UPDATE_INSTALLED') {
      await this.promptLiveUpdate(liveUpdate);
      return; // Don't check native if live update is available
    }

    // 2. Check native updates
    const nativeUpdate = await NativeUpdate.getAppUpdateInfo();
    if (nativeUpdate.updateAvailable) {
      await this.promptNativeUpdate(nativeUpdate);
    }
  }

  async promptLiveUpdate(update: any) {
    const alert = await this.alertCtrl.create({
      header: 'Update Available',
      message: `Version ${update.version} is ready to install`,
      buttons: [
        { text: 'Later', role: 'cancel' },
        {
          text: 'Update',
          handler: () => this.installLiveUpdate(),
        },
      ],
    });
    await alert.present();
  }

  async installLiveUpdate() {
    // The sync method already handles download if needed
    // Just reload to apply the update
    await NativeUpdate.reload(); // App restarts
  }

  // Request review after positive events
  async onPositiveEvent() {
    setTimeout(() => {
      NativeUpdate.requestReview();
    }, 2000);
  }
}

Configuration

capacitor.config.json

{
  "plugins": {
    "NativeUpdate": {
      "updateUrl": "https://updates.yourdomain.com/api/v1",
      "autoCheck": true,
      "checkInterval": 3600,
      "channel": "production",
      "publicKey": "YOUR_BASE64_PUBLIC_KEY",
      "appStoreId": "123456789",
      "enforceMinVersion": true
    }
  }
}

Platform Support

PlatformLive UpdatesApp UpdatesApp Reviews
iOS
Android
Web⚠️⚠️

⚠️ = Graceful fallback with limited functionality

Requirements

  • Capacitor 5.0+
  • iOS 13.0+
  • Android 5.0+ (API 21+)

Security

This plugin implements multiple security layers:

  • HTTPS enforcement for all update downloads
  • Public key signature verification for bundle integrity
  • Checksum validation before applying updates
  • Certificate pinning support for enhanced security

🎯 Complete Example Implementation

The example-app directory contains a complete, production-ready implementation:

Frontend (React + Capacitor)

  • ✅ All plugin features demonstrated
  • ✅ Live update management UI
  • ✅ App store update integration
  • ✅ In-app review prompts
  • ✅ Security implementation
  • ✅ Analytics dashboard
  • ✅ Error handling & recovery

Backend (Firebase Functions)

  • ✅ Complete update server
  • ✅ Bundle management API
  • ✅ Authentication & security
  • ✅ Analytics collection
  • ✅ Firestore + Storage integration
  • ✅ Auto-scaling infrastructure

🚀 Get started: See example-app/README.md for setup instructions.

Contributing

We welcome contributions! Please see our Contributing Guide for details.

🛠️ CLI Tools & Utilities

Zero-Install CLI Access

All tools are available via npx without cloning the repo:

# Quick start
npx native-update init --example
npx native-update backend create express --with-admin

Available Commands

Bundle Management

  • Create bundles: npx native-update bundle create ./www
  • Sign bundles: npx native-update bundle sign bundle.zip --key private.pem
  • Verify signatures: npx native-update bundle verify bundle.zip --key public.pem

Key Management

  • Generate keys: npx native-update keys generate --type rsa --size 4096
  • Supports RSA (2048/4096) and EC (256/384) keys
  • Creates timestamped key pairs with proper permissions
  • See Key Management Guide for detailed instructions

Backend Templates

  • Express.js: npx native-update backend create express --with-admin
  • Firebase: npx native-update backend create firebase --with-monitoring
  • Vercel: npx native-update backend create vercel

Development Tools

  • Start dev server: npx native-update server start --port 3000
  • Monitor updates: npx native-update monitor --server https://your-server.com
  • Validate config: npx native-update config check

Migration Tools

  • From CodePush: npx native-update migrate --from codepush

See CLI Reference for complete documentation.

🏗️ Development Status

What This Package Provides

Architecture & Design

  • Well-designed TypeScript interfaces and plugin structure
  • Modular architecture for live updates, app updates, and reviews
  • Security-first design patterns

Documentation

  • Comprehensive API documentation
  • Security best practices guide
  • Implementation examples and guides

Foundation Code

  • TypeScript/Web implementation
  • Plugin interfaces and definitions
  • Basic native platform stubs

What You Need to Build

Backend Infrastructure

  • Update server with API endpoints
  • Bundle storage and CDN
  • Version management system
  • Signing and encryption services

Complete Native Implementation

  • Verify and complete iOS implementation
  • Verify and complete Android implementation
  • Platform-specific testing

Testing & Quality Assurance

  • Unit tests for all modules
  • Integration tests
  • End-to-end testing
  • Security testing

Tooling & Utilities

  • Bundle creation tools
  • Signing utilities
  • Deployment scripts
  • Monitoring solutions

🚀 Getting Started with Development

  • Understand the Architecture:

    • Review the documentation in /docs/
    • Study the TypeScript interfaces in /src/definitions.ts
    • Check the ROADMAP.md for development priorities
  • Build Required Infrastructure:

    • Set up an update server (see server requirements)
    • Implement bundle storage solution
    • Create signing infrastructure
  • Complete Native Implementation:

    • Test and verify iOS implementation
    • Test and verify Android implementation
    • Ensure all plugin methods work correctly
  • Create Testing Suite:

    • Add unit tests for TypeScript code
    • Create integration tests for native platforms
    • Implement end-to-end testing scenarios

💡 Key Benefits

  • Zero Downtime Updates: Deploy fixes instantly without app store delays
  • Native Integration: Seamless platform-specific implementations
  • Developer Friendly: Comprehensive TypeScript support and documentation
  • Community Driven: Open-source with active community support
  • Professional Support: Enterprise support options available

🤝 Community & Support

This package is open-source and created by Ahsan Mahmood for the developer community. We welcome contributions, feedback, and collaboration.

Community Resources

Professional Support

  • Custom Implementation: Tailored solutions for your needs
  • Security Audits: Professional security assessments
  • Performance Optimization: Performance tuning and optimization
  • Training and Consulting: Team training and consultation

📈 Why Use This Foundation?

  • Solid Architecture: Well-designed plugin structure and interfaces
  • Platform Agnostic: Works with any JavaScript framework
  • Security-First: Built with security best practices in mind
  • Comprehensive Documentation: Detailed guides for implementation

License

MIT License - see LICENSE for details.

Support

Author

Ahsan Mahmood

Keywords

capacitor

FAQs

Package last updated on 19 Aug 2025

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

About

Packages

Stay in touch

Get open source security insights delivered straight into your inbox.

  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc

U.S. Patent No. 12,346,443 & 12,314,394. Other pending.