We're hitting a real catch-22 shipping a Capacitor iOS app right now, and since Capacitor and Cordova are both on Apple's "commonly used third-party SDK" signature list, this is likely affecting every app trying to comply with current App Store requirements, not just ours.
The bind:
-
Apple's App Review is rejecting submissions with ITMS-90111 ("Unsupported SDK or Xcode version, app submissions must use the latest Xcode and SDK Release Candidates") whenever the app bundles a framework built with an older SDK. The official Capacitor.xcframework/Cordova.xcframework from capacitor-swift-pm (checked through 8.4.2 and 9.0.0-alpha.6, both published mid-July 2026) are still built with Xcode 26.0/iOS 26.0, not rebuilt against anything newer even though Xcode 26.6 has been out for a while.
-
To work around that, we rebuilt Capacitor.framework and Cordova.framework ourselves from the open source 8.4.1 tag, compiled with the current Xcode. That fixed ITMS-90111, but broke something else: Apple's SDK signature program requires "commonly used" SDKs to carry a signature that only the registered publisher, Drifty Co in this case, can produce (we confirmed the official binary carries one at the xcframework level, _CodeSignature/, tied to Team ID 9YN2HU59K8, and that our rebuild has none, since it's cryptographically bound to the exact compiled bytes of your release). Self-rebuilding structurally can't produce a valid signature no matter how faithfully we compile from your own source.
-
We confirmed both failure modes directly and cleanly: our rebuilt frameworks (current SDK, no valid signature) get ITMS-91065. The genuine official 8.4.1 frameworks (valid signature, stale SDK) get ITMS-90111, verbatim RC-requirement text, on a completely unrelated stable Xcode 26.6 host, ruling out any host-machine explanation.
So right now there is no way to ship a compliant Capacitor iOS app: current-SDK builds fail the signature check, and signed builds fail the SDK-freshness check.
Ask: is there a release planned that rebuilds the xcframework binaries against a current Xcode/SDK while keeping the real Apple SDK signature intact? Given Apple's tightened enforcement this cycle, this seems likely to hit a lot of Capacitor apps soon if it hasn't already. Happy to share our test archives/logs if useful for reproducing this.
We're hitting a real catch-22 shipping a Capacitor iOS app right now, and since Capacitor and Cordova are both on Apple's "commonly used third-party SDK" signature list, this is likely affecting every app trying to comply with current App Store requirements, not just ours.
The bind:
Apple's App Review is rejecting submissions with ITMS-90111 ("Unsupported SDK or Xcode version, app submissions must use the latest Xcode and SDK Release Candidates") whenever the app bundles a framework built with an older SDK. The official
Capacitor.xcframework/Cordova.xcframeworkfromcapacitor-swift-pm(checked through 8.4.2 and 9.0.0-alpha.6, both published mid-July 2026) are still built with Xcode 26.0/iOS 26.0, not rebuilt against anything newer even though Xcode 26.6 has been out for a while.To work around that, we rebuilt Capacitor.framework and Cordova.framework ourselves from the open source 8.4.1 tag, compiled with the current Xcode. That fixed ITMS-90111, but broke something else: Apple's SDK signature program requires "commonly used" SDKs to carry a signature that only the registered publisher, Drifty Co in this case, can produce (we confirmed the official binary carries one at the xcframework level,
_CodeSignature/, tied to Team ID 9YN2HU59K8, and that our rebuild has none, since it's cryptographically bound to the exact compiled bytes of your release). Self-rebuilding structurally can't produce a valid signature no matter how faithfully we compile from your own source.We confirmed both failure modes directly and cleanly: our rebuilt frameworks (current SDK, no valid signature) get ITMS-91065. The genuine official 8.4.1 frameworks (valid signature, stale SDK) get ITMS-90111, verbatim RC-requirement text, on a completely unrelated stable Xcode 26.6 host, ruling out any host-machine explanation.
So right now there is no way to ship a compliant Capacitor iOS app: current-SDK builds fail the signature check, and signed builds fail the SDK-freshness check.
Ask: is there a release planned that rebuilds the xcframework binaries against a current Xcode/SDK while keeping the real Apple SDK signature intact? Given Apple's tightened enforcement this cycle, this seems likely to hit a lot of Capacitor apps soon if it hasn't already. Happy to share our test archives/logs if useful for reproducing this.