Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
sp-react-native-in-app-updates
Advanced tools
Handles Android native updates in app by using play-core
This is a react-native native module that works on both iOS and Android, and checks the stores (play/app) for a new version of your app and can prompt your user for an update.
It uses embedded in-app-updates via Play-Core on Android (to check & download google play patches natively from within the app), and react-native-siren on iOS (to check & navigate the user to the AppStore).
Because to this day I'm not aware of any react-native libraries that use play core to offer embedded in-app-updates besides this one
$ npm install sp-react-native-in-app-updates --save
On iOS you may need to also add the following lines in your Info.plist to be able to launch the store deep link.
<key>LSApplicationQueriesSchemes</key>
<array>
<string>itms-apps</string>
</array>
This project uses react-native-device-info
in the background. Install it to ensure everything works correctly.
In order to make it work using Expo you need to replace react-native-device-info dependency.
react-native-device-info.js
file in root with following content. Requires expo-constants dependency.import Constants from "expo-constants"
export const getVersion = () => {
return Constants.expoConfig?.version
}
plugins: [
[
'module-resolver',
{
root: ['.'],
alias: {
'react-native-device-info': './react-native-device-info.js'
}
}
],
...
]
import SpInAppUpdates, {
NeedsUpdateResponse,
IAUUpdateKind,
StartUpdateOptions,
} from 'sp-react-native-in-app-updates';
const inAppUpdates = new SpInAppUpdates(
false // isDebug
);
// curVersion is optional if you don't provide it will automatically take from the app using react-native-device-info
inAppUpdates.checkNeedsUpdate({ curVersion: '0.0.8' }).then((result) => {
if (result.shouldUpdate) {
let updateOptions: StartUpdateOptions = {};
if (Platform.OS === 'android') {
// android only, on iOS the user will be promped to go to your app store page
updateOptions = {
updateType: IAUUpdateKind.FLEXIBLE,
};
}
inAppUpdates.startUpdate(updateOptions); // https://github.com/SudoPlz/sp-react-native-in-app-updates/blob/master/src/types.ts#L78
}
});
// 👇🏻 (optional)
inAppUpdates.checkNeedsUpdate({ country: 'it' }).then(result => {
if (result.shouldUpdate) {
const updateOptions: StartUpdateOptions = Platform.select({
ios: {
title: 'Update available',
message: "There is a new version of the app available on the App Store, do you want to update it?",
buttonUpgradeText: 'Update',
buttonCancelText: 'Cancel',
country: 'it', // 👈🏻 the country code for the specific version to lookup for (optional)
},
android: {
updateType: IAUUpdateKind.IMMEDIATE,
},
});
inAppUpdates.startUpdate(updateOptions);
}
});
checkNeedsUpdate(checkOptions: CheckOptions) : Promise<NeedsUpdateResponse>
Checks if there are any updates available.
Where:
CheckOptions
Options | Type | Description |
---|---|---|
curVersion | (required) String | The semver of your current app version |
toSemverConverter | (optional) Function | This will run right after the store version is fetched in case you want to change it before it's compared as a semver |
customVersionComparator | (optional) Function | By default this library uses semver behind the scenes to compare the store version with the curVersion value, but you can pass your own version comparator if you want to |
country (iOS only) | (optional) String | default undefined , it will filter by country code while requesting an update, The value should be ISO 3166-1 country code |
and NeedsUpdateResponse
:
Result | Type | Description |
---|---|---|
shouldUpdate | Boolean | Whether there's a newer version on the store or not |
storeVersion | String | The latest app/play store version we're aware of |
other | Object | Other info returned from the store (differs on Android/iOS) |
startUpdate(updateOptions: StartUpdateOptions) : Promise
Shows pop-up asking user if they want to update, giving them the option to download said update.
Where:
StartUpdateOptions
Option | Type | Description |
---|---|---|
updateType (Android ONLY) | (required on Android) IAUUpdateKind | Either IAUUpdateKind.FLEXIBLE or IAUUpdateKind.IMMEDIATE . This uses play-core below the hood, read more here about the two modes. |
title (iOS only) | (optional) String | The title of the alert prompt when there's a new version. (default: Update Available ) |
message (iOS only) | (optional) String | The content of the alert prompt when there's a new version (default: There is an updated version available on the App Store. Would you like to upgrade? ) |
buttonUpgradeText (iOS only) | (optional) String | The text of the confirmation button on the alert prompt (default: Upgrade ) |
buttonCancelText (iOS only) | (optional) String | The text of the cancelation button on the alert prompt (default: Cancel ) |
forceUpgrade (iOS only) | (optional) Boolean | If set to true the user won't be able to cancel the upgrade (default: false ) |
bundleId (iOS only) | (optional) String | The id that identifies the app (ex: com.apple.mobilesafari). If undefined, it will be retrieved with react-native-device-info. (default: undefined ) |
country (iOS only) | (optional) String | If set, it will filter by country code while requesting an update, The value should be ISO 3166-1 country code (default: undefined ) |
versionSpecificOptions (iOS only) | (optional) Array<IosStartUpdateOptionWithLocalVersion> | An array of IosStartUpdateOptionWithLocalVersion that specify rules dynamically based on what version the device is currently running. (default: undefined ) |
installUpdate() : void
(Android only)Installs a downloaded update.
addStatusUpdateListener(callback: (status: StatusUpdateEvent) : void) : void
(Android only)Adds a listener for tracking the current status of the update download.
Where: StatusUpdateEvent
Option | Type | Description |
---|---|---|
status | AndroidInstallStatus | The status of the installation (https://developer.android.com/reference/com/google/android/play/core/install/model/InstallStatus) |
bytesDownloaded | int | How many bytes were already downloaded |
totalBytesToDownload | int | The total amount of bytes in the update |
removeStatusUpdateListener(callback: (status: StatusUpdateEvent) : void): void
(Android only)Removes an existing download status listener.
Debugging in-app-updates is tricky, so arm yourself with patience, enable debug logs by passing true to our library constructor. To enable console.log
for release you may need react-native log-android
or react-native log-ios
.
First of all use a REAL device.
(you don't like the debug variant right? Neither do we, but we couldn't find an easier way to check that everything's working fine - debug builds don't work with in-app-updates unfortunately)
This is what you'd be updating to
Make sure that the button within that link says UPDATE (and NOT install)
That means google play knows there's an available update
Haven't really found any easier ways to test that everything works, but hey.. it get's the job done
Keep in mind that this library is JUST a WRAPPER of the in-app-update api, so if you have trouble making in-app-updates work it's most probably because you're doing something wrong with google play.
Important: If the app you are testing doesn’t appear with an available update, don't bother checking for updates programmatically, because you'll probably never see any available updates via code either.
This library is offered as is, if you'd like to change something please open a PR
Read the CHANGELOG.md file
MIT
FAQs
Handles Android native updates in app by using play-core
The npm package sp-react-native-in-app-updates receives a total of 11,063 weekly downloads. As such, sp-react-native-in-app-updates popularity was classified as popular.
We found that sp-react-native-in-app-updates demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.