release: freeRASP 3.2.0 (Android SDK 19.2.1, iOS SDK 7.1.2) - #55
Merged
Conversation
Bump TalsecSecurity-Community-Capacitor to 19.2.1 and migrate the Android bridge to the SDK's new package and callback names. 19.2.1 moves the SDK from com.aheaditec.talsec_security.security.api to app.talsec.rasp.security.api and renames every ThreatListener callback to match its threat name (onRootDetected -> onPrivilegedAccess, onADBEnabledDetected -> onAdbEnabled, and so on). Expose the release's new onBootloader() callback as the Android-only `bootloader` threat. The native ALL_EVENTS list and the TypeScript Android getValues() branch are matched by position, so Bootloader is appended to both; the iOS list is unchanged. Resolve the SDK's JitPack dependencies from the Talsec common registry instead of jitpack.io. Co-authored-by: Cursor <cursoragent@cursor.com>
3.1.0 is already published (Swift Package Manager support, iOS SDK 7.1.1), so the SDK 19.2.1 notes belong in a new release rather than that section. Move the notes into a 3.2.0 section at the top of the changelog, removing the duplicate 3.1.0 heading, and correct the iOS SDK line to 7.1.1 — that version is unchanged by this release. Co-authored-by: Cursor <cursoragent@cursor.com>
tompsota
changed the title
Update TalsecRuntime.xcframework to 7.1.2 and point the SPM binary target at the matching published zip. Public Swift API gained ScreenCaptureBlockError; the change is additive, so the plugin bridge is unchanged.
tompsota
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Rolls Android Talsec SDK 19.2.1 into the Capacitor plugin (from 18.3.0) and bumps the plugin to 3.2.0. Also rolls the iOS TalsecRuntime to 7.1.2 (from 7.1.1).
SDK package and callback migration (required)
19.2.1 is a breaking SDK release beyond what the release notes describe:
com.aheaditec.talsec_security.security.apitoapp.talsec.rasp.security.api(6 Kotlin files).ThreatListenercallback was renamed to match its threat name —onRootDetected()→onPrivilegedAccess(),onUnlockedDeviceDetected()→onPasscode(),onADBEnabledDetected()→onAdbEnabled(),onSystemVPNDetected()→onSystemVpn(), and so on for all 21.Because the package moved as well, this fails to compile rather than silently delivering no threats.
New
bootloaderthreat (Android only)The release adds
onBootloader(), reporting an unlocked or compromised bootloader. It is plumbed through as thebootloadercallback onThreatEventActions.Native
ThreatEvent.ALL_EVENTSand the TypeScript Android branch ofThreat.getValues()are matched by position, soBootloaderis appended to both (22 entries each). The iOS list is unchanged at 14, following the existingautomationprecedent.Dependency resolution
jitpack.iois replaced byhttps://europe-west3-maven.pkg.dev/talsec-artifact-repository/common, which mirrors the SDK's two JitPack dependencies (fingerprint-android,truetime-android).Other
dist/rebuilt withnpm run build.Bootloaderrow and handler.onMalwaredropped a dead?: mutableListOf()elvis on a non-null parameter.iOS SDK 7.1.2
TalsecRuntime.xcframeworkgoes from 7.1.1 to 7.1.2, and the SPM binary target inPackage.swiftnow points at the 7.1.2 zip with checksumdb6c4236bb9619b9c19ccada6b6787c137da2d72cc2e52c73537404c080024b3, verified byte-for-byte against the published artifact.The framework diff is modification-only — nothing added or removed. The public Swift API gains exactly one additive type,
ScreenCaptureBlockError; no existing declaration changed, so no plugin bridge changes were needed.dSYMs are attached to this description.
Test plan
npm run build— plugin anddist/rebuild cleanly; only threat-related files changed.npm run lint— ESLint and Prettier pass.Example app assembles for Android against SDK 19.2.1 (JDK 21).
Example app runs on a Pixel 9 Pro API 34 emulator, logs
freeRASP: All checks finished, and is not killed — the real assertion that the native and TypeScript identifier lists are aligned, since a length or index mismatch triggersonInvalidCallback().The new
Bootloaderrow renders in the example app.Example app builds for the iOS simulator. SPM resolves the 7.1.2 binary target from the remote zip, which independently validates the
Package.swiftchecksum.Example app runs on an iPhone 17 Pro simulator (iOS 26.1) for 70s without crashing, reports All checks finished, and embeds TalsecRuntime 7.1.2.
Threats flagged red on the emulator (app integrity, debug, emulator, unofficial store, obfuscation issues, malware, ADB, passcode, secure hardware) are the expected debug-build-on-emulator set.
dSYMs.zip