expo-updates
Fetches and manages remotely-hosted assets and updates to your app's JS bundle.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:nullthrows | AI (phantom-deps): nullthrows is declared and used transitively in expo-updates config/build files; stable FP. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): expo-updates is a large monorepo package; version numbering gaps are expected; publisher is well-established with 5900 approved packages. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Occurs in e2e/setup/project.ts test scaffolding, not runtime code; standard pattern for passing env to child processes in tests. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Fires in e2e test fixture files (maestro/updates-server), not shipped runtime code; loading test JSON by path is benign. | ai | |
| dependencies | unvetted-dep:expo-structured-headers | AI (dependencies): Expo monorepo sibling package; expected dependency for expo-updates. | ai | |
| dependencies | unvetted-dep:expo-eas-client | AI (dependencies): Expo monorepo sibling package; expected dependency for expo-updates. | ai | |
| dependencies | unvetted-dep:expo-updates-interface | AI (dependencies): Expo monorepo sibling package; expected dependency for expo-updates. | ai | |
| provenance | no-provenance | AI (provenance): Expo packages consistently publish without Sigstore provenance; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:resolve-from | AI (phantom-deps): CLI tooling dependency; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:expo-structured-headers | AI (phantom-deps): Expo monorepo sibling; phantom-dep heuristic fires on native module patterns. | ai | |
| phantom-deps | phantom-dep:expo-updates-interface | AI (phantom-deps): Expo monorepo sibling; phantom-dep heuristic fires on native module patterns. | ai | |
| phantom-deps | phantom-dep:expo-eas-client | AI (phantom-deps): Expo monorepo sibling; phantom-dep heuristic fires on native module patterns. | ai |
Versions (showing 41 of 41)
| Version | Deps | Published |
|---|---|---|
| 56.0.17 | 15 / 19 | |
| 56.0.16 | 15 / 19 | |
| 56.0.14 | 15 / 19 | |
| 56.0.13 | 15 / 19 | |
| 56.0.12 | 15 / 19 | |
| 56.0.11 | 15 / 19 | |
| 56.0.10 | 15 / 19 | |
| 56.0.9 | 15 / 19 | |
| 56.0.8 | 15 / 19 | |
| 56.0.7 | 15 / 19 | |
| 56.0.6 | 15 / 19 | |
| 56.0.5 | 15 / 19 | |
| 56.0.4 | 15 / 19 | |
| 56.0.3 | 15 / 19 | |
| 56.0.2 | 15 / 19 | |
| 56.0.1 | 15 / 17 | |
| 56.0.0 | 15 / 17 | |
| 55.0.24 | 14 / 11 | |
| 55.0.23 | 14 / 11 | |
| 55.0.22 | 14 / 11 | |
| 55.0.21 | 14 / 11 | |
| 55.0.20 | 14 / 11 | |
| 55.0.19 | 14 / 11 | |
| 55.0.18 | 14 / 11 | |
| 55.0.17 | 14 / 11 | |
| 55.0.12 | 14 / 11 | |
| 55.0.11 | 14 / 11 | |
| 55.0.7 | 14 / 11 | |
| 55.0.6 | 14 / 11 | |
| 55.0.5 | 14 / 11 | |
| 55.0.4 | 14 / 11 | |
| 55.0.3 | 14 / 11 | |
| 55.0.2 | 14 / 11 | |
| 55.0.1 | 14 / 11 | |
| 55.0.0 | 14 / 11 | |
| 29.0.18 | 14 / 13 | |
| 29.0.17 | 14 / 13 | |
| 29.0.16 | 14 / 13 | |
| 29.0.15 | 14 / 13 | |
| 29.0.14 | 14 / 13 | |
| 29.0.13 | 14 / 13 |
v56.0.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.11
2 findingsThis version was published by a different npm account than previous versions on 2026-05-14. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v55.0.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v55.0.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v55.0.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v55.0.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.2
2 findingsThis version was published by a different npm account than previous versions on 2026-01-22. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.0
2 findingsThis version was published by a different npm account than previous versions on 2026-01-21. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v29.0.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v29.0.17
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/expo/expo/blob/dd4e87727c4ef32ac5d8a7b5a42fd80da254140f/e2e/setup/project.ts#L836 834 | 835 | await spawnAsync(localCliBin, ['prebuild', '--no-install', '--template', localTemplatePathName], { > 836 | env: { 837 | ...process.env, 838 | EXPO_DEBUG: '1',
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v29.0.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v29.0.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v29.0.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v29.0.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.