Security advisory notifications

Capgo publishes security advisories on GitHub when issues affect our npm packages. This page explains how to get notified by email when a new advisory is published, and how to consume the same data from a machine-readable JSON feed.

Caution

The security updates subscription form and the hosted JSON feed are deployed with the Capgo security advisory notification service. Until that deployment is public, use the per-repository advisory listings below as the authoritative record on GitHub. This page documents the behavior so you can plan integrations before the public URLs are announced.

What you receive

Security advisory notifications are optional. When you subscribe, Capgo sends email only after we publish a GitHub security advisory that affects one or more of these npm scopes:

• @capgo/capacitor-updater
• Other Cap-go capacitor-* plugins published under @capgo
• @capgo/cli

Each notification email summarizes the advisory in plain language. It includes:

• The affected version range for each listed package
• The patched version for each affected major release line when a fix is available
• Upgrade steps for each affected package:
  • @capgo/cli: Install the patched CLI (for example npm install -g @capgo/cli@<patched_version> or bump the version your CI uses). A CLI-only advisory does not require npx cap sync or a new native store build.
  • Capacitor plugins (@capgo/capacitor-updater and other @capgo/capacitor-* packages): Install the patched npm package, run npx cap sync, then rebuild and ship your native app so the updated native plugin code is included.

Capgo does not use these emails for marketing. They are limited to published security advisories for the packages above.

Note

Live updates from Capgo deliver web bundles, including JavaScript, HTML, and CSS. Security fixes in native plugin code still require updating the npm package, syncing Capacitor, and releasing a new store build. When an advisory lists only @capgo/cli, updating the CLI is enough for that fix. Treat advisory emails as a prompt to follow the upgrade steps for each listed package, not only a live update bundle.

How to subscribe

Subscription uses double opt-in by email.

1. Submit your email address on the security updates subscription form (hosted with the advisory notification service; the public URL is configured at deploy time). The form sends a Cloudflare Turnstile token with your request so Capgo can verify the submission before sending a confirmation email.
2. Open the confirmation message and click the link inside it to confirm you want alerts.
3. After confirmation, you receive email when new qualifying advisories are published.

Every notification includes an unsubscribe link. Use it to stop future messages without contacting support.

Machine-readable advisory feed

Automation and internal tools can poll the same advisory set as JSON. The HTTP endpoint is:

GET {ADVISORY_API_BASE_URL}/v1/advisories

Replace {ADVISORY_API_BASE_URL} with the base URL Capgo publishes when the hosted advisory API is live (for example the same origin that serves the subscription form). Self-hosted or staging stacks set this value in their own deployment config. The path is always /v1/advisories.

The response is a JSON object matching the types below.

type AdvisoryAffected = {
  package: string
  affected_range: string
  patched_version: string | null
  capacitor_plus_version?: string
}

type Advisory = {
  id: string
  ghsa_id: string
  cve_id?: string
  title: string
  severity: 'low' | 'moderate' | 'high' | 'critical'
  affected: AdvisoryAffected[]
  fix_steps: string
  published_at: string
  url: string
  plus_release_url?: string
}

type AdvisoryFeed = {
  advisories: Advisory[]
  generated_at: string
}

Field notes:

Field	Meaning
affected_range	Semver range of versions impacted for that package
patched_version	First fixed version on the relevant major line, or null if no fix is published yet
capacitor_plus_version	When Capacitor+ bundles a related fix, the Capacitor+ version that includes it
fix_steps	Human-readable remediation text aligned with the notification email (CLI-only vs native plugin steps as applicable)
published_at	ISO 8601 timestamp when the advisory was published
url	Canonical link to the GitHub security advisory
plus_release_url	Link to a Capacitor+ release when applicable
generated_at	ISO 8601 timestamp when this JSON snapshot was built

Example request with a placeholder base URL:

curl -sS "{ADVISORY_API_BASE_URL}/v1/advisories"

Poll politely. Prefer ETag or If-Modified-Since when your client supports conditional requests, and back off on errors.

Full advisory list on GitHub

Email and JSON feeds mirror published advisories. For per-package history, open the Security tabs on the repositories that publish advisories, including capacitor-updater and capgo.app (including published advisories that affect @capgo/cli).

Keep going

• Updater getting started to install and configure @capgo/capacitor-updater
• Versioning for how Capgo maps fixes across Capacitor major versions
• Compliance for data handling and security practices on the live update service