$ show reactnativecn/react-native-update
This repository is the `react-native-update` SDK (branded as Pushy for China and Cresc globally), a production-grade over-the-air (OTA) update library for React Native applications. It enables incremental patching of JavaScript bundles (including Hermes bytecode) and native resources across iOS, Android, and HarmonyOS platforms. The system comprises a JavaScript layer (React context, hooks, client classes) that orchestrates check, download, patch, and switch operations, and native modules on each platform that handle binary patching (via HDiffPatch/LZMA), secure zip extraction, resumable downloads, and a native cold-start check that can recover from crashes without JS involvement. The core patching and decision logic is implemented in C++ and shared across all platforms, enforced by golden-vector test suites. The SDK supports staged rollouts, telemetry, error reporting, crash rescue, and multiple update strategies (silent, alert, etc.). It is not a standalone application but a library integrated into React Native apps, with extensive CI/CD, unit tests, and e2e tests.
The LLM identified 5 files worth highlighting for reuse:
A pure TypeScript module that implements the update decision pipeline: building check request bodies, computing rollout fingerprints (Murmur3), resolving endpoint ordering, deciding download plans (diff/pdiff/full), and validating responses. It has no IO or side effects, making it independently testable and portable. The same logic is ported to C++ and verified against golden vectors generated from this module, ensuring cross-platform consistency. This component could be extracted and reused in any OTA update system requiring a deterministic decision layer.
Implements a hedged request race (`selectFastestSuccessfulEndpoint`) and endpoint fallback (`executeEndpointFallback`) for resilient HTTP calls. It concurrently tests multiple endpoints (configured + remote mirrors), cancels slower ones upon first success, prunes failures, and retries with remaining endpoints. This pattern is reusable in any system needing low-latency, fault-tolerant network requests without external dependencies.
The core C++ patching engine that applies binary diffs (hdiff) to JS bundles and native resources, including Hermes bytecode (HBC) transform for delta-friendly patching. It implements a state machine for version switching, rollback, and success marking, with security bounds (archive size/entry/compression ratio caps, LZMA dictionary limits, path traversal prevention). This component is self-contained with minimal dependencies and could be reused in any binary patching or update system requiring robust, secure patch application.
A secure zip extraction utility that pre-inspects archive entries (count, sizes, compression ratio) against configurable limits, rejects reserved names (`.pushy-` prefix), prevents path traversal, and enforces stream-level budgets. It wraps `ZipInputStream` with strict validation and cleanup. This class is a standalone, well-documented component that can be reused in any Android project requiring safe handling of untrusted zip archives.
A cross-launch resumable downloader for iOS that uses a sidecar JSON file (`<archive>.resume`) to persist URL, ETag, Last-Modified, and total bytes across app restarts. It supports `Range`/`If-Range` headers, handles 206/416 responses, enforces archive size caps and disk space checks, and integrates with the C++ patch core. The downloader is a self-contained Objective-C++ class that can be extracted and reused in any iOS project needing robust, resumable downloads with security constraints.