What are Over-The-Air (OTA) updates through EAS Update, and what are their risks?

Short answer

They send immediate updates and fixes for JavaScript bundles and assets directly to users' devices without rebuilding the app or waiting for App Store/Google Play review.

Explanation

When you find a critical bug in the UI or JavaScript code, you can run eas update to download the update in the background to users' phones when they open the app. OTA updates cannot change native code (for example, by adding a new native library), and using them to secretly change an app's core functionality may violate store policies.

Code example

import * as Updates from "expo-updates";

export async function applyUpdateIfAny() {
  const check = await Updates.checkForUpdateAsync();
  if (check.isAvailable) {
    await Updates.fetchUpdateAsync();
    await Updates.reloadAsync();         // restarts the app with the new JS bundle
  }
}

// Publish a JS/assets-only update to the production channel:
//   eas update --channel production --message "Fix payment screen"
// Native code changes still require a new store build (the runtimeVersion must match).

Common mistakes

• Trying to send an OTA update that contains a new native library requiring C++/Java/Swift changes without releasing a new store build, causing the app to crash immediately.

Follow-up questions

• What is EAS Build, and how does it differ from building locally on a developer's machine?

Sources

• Expo docs — EAS Update introduction