Added

• An iOS beta build image is available on the beta servers, with macOS 26.7.2, Xcode 26.6, Node.js 26.13.0 and npm 12.2.2. To use it, email support@volt.build and ask for beta access, then check Build using beta servers? on the upload page. The beta announcement on the forum lists what we’d like testers to check. The versions on the Build environment page are for the default servers. Node.js 26.13.0 includes the fix for CVE-2026-111497; see the security statement.

Changed

• The default Android build image was rebuilt on 4 November. The main change is Node.js, which moves from 24.x to 26.x. npm goes from 12.2.0 to 12.2.1, Gradle from 8.14.5 to 8.14.6 and Kotlin from 2.4.20 to 2.4.21. The Cordova CLI, the JDKs, the Android build-tools and platforms, and the pre-cached cordova-android versions are unchanged. The full list is on the Build environment page. The Node.js version on this image includes the fix for CVE-2026-111497; see the security statement.

Signing in

Fixed

• If your browser blocks session storage, clicking Log in now shows “Sign-in couldn’t start because this browser is blocking session storage. Enable site storage, then try again.”
• If your browser blocks local storage, or has no room left in it, the page now shows a notice when it loads: “Sign-in requires browser site storage. Enable storage for this site or free up browser storage, then try logging in again.” Log in does not start a sign-in while that notice is showing, and it goes away once storage works again.

Documentation

Fixed

• The documentation pages no longer raise a script error when the browser blocks session storage. In that case the side menu does not remember its scroll position between pages.

Added

• Capacitor iOS builds can now be signed with more than one provisioning profile, for projects that include an app extension such as a share extension. List the extra profiles in voltbuilder.json as project-relative paths: iosDevelopmentExtra for a debug build, iosDistributionExtra for a release build. Each target is signed with the profile whose bundle identifier matches it, an exact match first and otherwise the longest wildcard match, and the same set of profiles is used when the archive is exported. If a target has no matching profile the build stops with “No provisioning profile found for iOS target” and the target’s name and bundle identifier. An extra profile path that does not exist, points outside the project, or is not a file is rejected by the pre-build check, and a profile with a malformed UUID gives a “Malformed mobileprovision” error. See Signing app extensions in the Capacitor setup guide.
• The documentation now has a Build environment page listing the tools and versions on the Android and iOS build servers. For Android it covers the operating system, Node.js, npm, the Cordova CLI, Gradle, Kotlin, the JDKs, and the Android build-tools and platforms. It also gives the JDK, build-tools and platform used for each cordova-android release, and which Java version Cordova and Capacitor builds use. For iOS it lists macOS, Xcode, Node.js, npm, the Cordova CLI, CocoaPods and the pre-cached cordova-ios versions.

Changed

• In Capacitor iOS builds, the manual signing settings are now applied only to the app, app extension, watch and App Clip targets, and only to the configuration being built: Debug for a debug build, Release for a release build. Before, every Debug and Release configuration that set a signing style was switched to your profile, and frameworks and static libraries in the project were not exempt. A project with an extension target and no profile that matches it, which previously built with your single profile applied to everything, now stops with the “No provisioning profile found” error above.
• The comparison table on the About page now shows the current Xcode (26.2), Cordova (13.0.0) and Android API (36.1) versions. It previously showed Xcode 13.4.0, Cordova 10.1.1 and Android API 30.

Uploads

Fixed

• If your subscription had expired, the upload page told you “Your account is not authorized to use the build service. Please contact support.” It now says “Your subscription expired on” followed by the date, asks you to renew your plan before uploading, and links to the plans page. The upload buttons stay disabled.
• If the upload page could not load your build status when it opened, the upload buttons stayed disabled after a later Check status succeeded, until you reloaded the page. They are now enabled again as soon as the status check succeeds.
• When the sign-in service timed out while the upload page was refreshing your session, the page told you “Authentication error: Timeout when executing ‘fetch’. Please log in again.”, and if it was following a build it stopped and showed the Log in button. A timeout is now handled like any other connection problem: the message says the sign-in service could not be reached and to check your connection, and during a build the Check status button is shown instead of Log in.

Changed

• While the upload page is following a build, it now refreshes your sign-in token before each status check, so a page left open for a long time keeps checking. If you need to sign in again, the page stops checking and shows the Log in button. If the token cannot be refreshed because of a network problem, it stops and keeps the Check status button. Either way the message says that your upload was accepted, that the build may still be running, and that the interruption does not mean the build failed.
• If the script that reads your plan from your sign-in token fails to load, the upload page now says “Upload is temporarily unavailable. Please refresh and try again.”, hides the login buttons and leaves uploads disabled.

API

Added

• POST /v1/app now returns an X-Request-ID response header on 401 responses as well, so a rejected upload carries an ID you can send us. On this route the value is a short hash of the X-Request-ID or X-Correlation-ID you sent, not the ID itself, and if you send neither it is generated. If you have a problem with the API, send us the request ID and we can find that request in our logs.

Builds

Changed

• The rebuilt Android build image from the September beta became the default for Android builds on 14 October. It is the image described in the September entry: built on Ubuntu 26.04, with JDK 8, 11, 17 and 21 chosen by your cordova-android version, and the Gradle, Kotlin, Node and Cordova versions pinned. The beta option on the upload page no longer sends an Android build to a separate queue.

Work continues on an iOS build image with Xcode 26.6 on macOS 26.7.1.

Uploads

Fixed

• For roughly five days, the upload page’s script did not run in Chrome 80 and other browsers of that age, because it used one piece of syntax they cannot parse. It is fixed. As far as we can tell, one person was affected.

Changed

• If the upload page cannot refresh a build’s status after your upload was accepted, it now says so: the upload was accepted and the build may still be running. After a server error or a dropped connection it retries after 5, 10 and 20 seconds, then shows a Check status button. Other failures show the message and the button straight away. The button that stops the page following a build is now labelled Stop monitoring, and the message after pressing it says the build may still be running on the server.

Signing in

Changed

• When a sign-in attempt cannot be completed, you now stay on the sign-in page with a message saying so, instead of being sent back to the home page. The message is still there if you reload, and signing in again takes you back to the page you were on. If you turn out to be signed in already, the page says that instead.

API

Added

• GET /v1/app and POST /v1/client now return an X-Request-ID response header, including on 401 and 403 responses, and browsers on allowed origins can read it. If you have a problem with the API, send us the request ID and we can find that request in our logs. If you send your own X-Request-ID (a UUID or 32 hex characters) it is returned unchanged. If you send X-Correlation-ID instead, that is used. Any other value is replaced by a short hash. The OpenAPI spec now documents POST /v1/client and the header.

Behind the scenes

• Security improvements to the build pipeline.

Most of it went into the upload and sign-in paths. We added front-end error monitoring in September, and it surfaced a long tail of problems nobody had reported to us — a browser silently blocking storage, a session expiring mid-upload, a large project timing out on a slow connection. Each one is rare on its own. Together they were enough to cost someone their first build. Most of what follows came out of working through that list.

Android build agent beta

The Android build image has been rebuilt from the ground up. It is now built directly on Ubuntu 26.04 with the toolchain versions pinned explicitly, replacing an image layered on top of a third-party Android SDK base.

• JDK 8, 11, 17 and 21, selected automatically for your cordova-android version
• Gradle 8.14.5 on the path, with 6.5, 7.1.1, 7.4.2, 7.6, 8.7, 8.13, 8.14.2 and 8.14.3 also cached, so whichever version your project’s Gradle wrapper asks for is already on the machine
• Kotlin 2.4.20
• Node 24, npm 12.2.0, Cordova 13
• Android build-tools 30.0.3 through 36.1.0; platforms android-29 through android-36.1
• Supports cordova-android 9 through 15, and Capacitor

The image is built by running a real build for every supported cordova-android version and for Capacitor, so the npm and Gradle caches are already warm when your build starts.

Three things worth knowing:

git is now installed in the build image. Plugins referenced by a git URL should install correctly.

npm’s git and install-script permissions have been restored. npm 12 tightened its defaults around git dependencies and packages that run install scripts, which broke some plugins. The image restores the previous behaviour.

A note on cordova-android 9. Apache’s last 9.x release was 9.1.0, in April 2021, and it resolves its dependencies through JCenter/Bintray, which has since shut down — so a stock cordova-android 9 project no longer builds anywhere. We maintain our own engine with that repaired, and it is the only way to build a 9.x project on VoltBuilder. It has to be requested explicitly in config.xml:

<engine name="android" spec="https://github.com/voltbuilder/cordova-android#9.1.1" />

A plain spec="9.0.0" is rejected; the minimum numeric engine is 10.0.0. We keep 9.x working rather than developing it, so if you are still on it, moving up is worth the time.

This is a beta. To take part, email support@volt.build to request access, then select the beta agent on the upload page.

Uploads

Fixed

• Submitting with no file selected, or with a file that is not a zip, now fails immediately with a clear message instead of starting a build that cannot succeed.
• Raised upload timeouts. Large projects on slower connections were timing out before the transfer finished.
• An upload interrupted part-way through now returns a clear incomplete-upload error rather than a server error.
• Fixed a server error when uploading from an account that had never run a build.
• Fixed an upload failure when the build ID was missing from the page, and made status polling continue correctly afterwards.
• Authorization problems during upload — an expired subscription, or a plan that does not allow the requested build — now report what actually went wrong.

Added

• Upload progress tracking, so a slow upload looks slow rather than stalled.
• When an upload fails because of a problem on our end, you now get a retry option and a direct route to support.
• Every upload carries a correlation ID. If you report a failed upload we can find that exact attempt in our logs rather than asking you to reproduce it.

Signing in

Fixed

• An expired session now returns you to the page you were on after signing back in, instead of dropping you at the start.
• Browsers that block storage access are now detected and reported clearly rather than failing silently.
• When the authentication service is slow or unreachable, the upload page degrades gracefully instead of breaking.
• Fixed several JavaScript errors that could leave a page unusable after a failed sign-in.

Builds

Fixed

• Android builds read the application ID from android-packageName again. This had regressed at some point. When android-packageName is present it takes precedence.

Added

• iosDevAppleId and iosDistAppleId let you specify which Apple ID is used for App Store Connect validation and upload. This matters if your developer account is associated with more than one Apple ID.

API

Added

• /v1/app uploads now return stable, documented reasons when a submission is rejected, instead of a bare status code. See the API specification.
• An API-Version header on every response, plus a documented versioning and release policy.
• Windows platform support is now documented.

Fixed

• An expired subscription now returns a clear EXPIRED_SUBSCRIPTION reason up front, rather than accepting the upload and rejecting it afterwards.

Behind the scenes

• Added front-end error monitoring across the site, which is where most of the fixes above came from.
• Routine dependency and security updates across all services.

Next

iOS builds are the current focus, along with further usability and reliability work, and something to help you work out which plugins will work with your project before you build.