release: freeRASP 9.1.0 (Android SDK 19.2.1, iOS SDK 7.1.2)

[tompsota]

Summary

Rolls Android Talsec SDK 19.2.1 into the Cordova plugin (from 18.3.0) and bumps the plugin to 9.1.0 in both package.json and plugin.xml. Also rolls the iOS TalsecRuntime to 7.1.2 (from 6.14.4).

SDK package and callback migration (required)

19.2.1 is a breaking SDK release beyond what the release notes describe:

• The package moved from com.aheaditec.talsec_security.security.api to app.talsec.rasp.security.api (6 Kotlin files).
• Every ThreatListener callback was renamed to match its threat name — onRootDetected() → onPrivilegedAccess(), onUnlockedDeviceDetected() → onPasscode(), onADBEnabledDetected() → onAdbEnabled(), onSystemVPNDetected() → onSystemVpn(), and so on for all 21.

Because the package moved as well, this fails to compile rather than silently delivering no threats.

New bootloader threat (Android only)

The release adds onBootloader(), reporting an unlocked or compromised bootloader. It is plumbed through as the bootloader callback on ThreatEventActions.

Native ThreatEvent.ALL_EVENTS and the TypeScript Android branch of Threat.getValues() are matched by position, so Bootloader is appended to both (22 entries each). The iOS list is unchanged at 14, following the existing automation precedent.

plugin.xml needed no new <source-file> entries — only files it already registers were edited.

Dependency resolution

jitpack.io is replaced by https://europe-west3-maven.pkg.dev/talsec-artifact-repository/common, which mirrors the SDK's two JitPack dependencies (fingerprint-android, truetime-android).

iOS SDK 7.1.2

TalsecRuntime.xcframework goes from 6.14.4 straight to 7.1.2, so the changelog covers three SDK releases: 6.14.5, 7.1.0 and 7.1.2.

The framework diff is modification-only — nothing added or removed. The public Swift API gains exactly one additive type, ScreenCaptureBlockError; no existing declaration changed, so no plugin bridge changes were needed.

dSYMs are attached to this description.

CI fix (unrelated to the SDK bump)

build-ios was already failing on this branch before the iOS framework was touched. cordova-ios derives the xcodebuild destination as platform=iOS Simulator,name=<device> with no OS component, so xcodebuild resolves OS:latest. The macos-latest runner image now carries several iOS runtimes (26.2, 26.4.1, 26.5) and the device cordova picks — iPhone 16e — only exists on 26.2, so the build died with Unable to find a device matching the provided destination specifier.

The job only compiles and never boots a simulator, so it now passes an explicit generic destination via cordova's supported --buildFlag override, which removes any dependence on which devices the runner image happens to create.

Test plan

• npm run typecheck passes.
• npm run eslint -- --max-warnings=0 and npm run prettier -- --check pass.
• npm run tsc && npm run build — www/dist/ regenerated and committed, so the verify-dist-build CI job stays green.
• Example app builds for Android against SDK 19.2.1 via ionic cordova build android, with the plugin installed from a clean out-of-tree source copy the way ci.yml does it.
• Example app runs on a Pixel 9 Pro API 34 emulator, logs freeRASP initialized and All checks finished, and is not killed — the real assertion that the native and TypeScript identifier lists are aligned, since a length or index mismatch triggers onInvalidCallback().
• The new Bootloader row renders in the example app.
• Example app builds for the iOS simulator via cordova build ios --emulator, with TalsecRuntime 7.1.2 confirmed under platforms/ios.
• build-ios passes in CI after the destination fix; all four checks green.
• Example app runs on an iPhone 17 Pro simulator (iOS 26.1) for 70s without crashing and reports All Checks Finished.

Threats flagged red on the emulator (app integrity, debug, emulator, unofficial store, obfuscation issues, malware, ADB, passcode, secure hardware) are the expected debug-build-on-emulator set.
dSYMs.zip

Made with Cursor