Capacitor 8.4.1/9.0.0-alpha frameworks are stale (Xcode 26.0), self-rebuilding to fix it breaks Apple's SDK signature (ITMS-91065)

Capacitor
1

We’re hitting a catch-22 shipping a Capacitor iOS app right now, and since Capacitor and Cordova are both on Apple’s “commonly used third-party SDK” signature list, this is likely hitting every app that ships with the official frameworks, not just ours.

The bind:

  1. App Store Connect rejects submissions with ITMS-90111 (“Unsupported SDK or Xcode version”) when the app bundles a framework built with an older SDK. The official Capacitor.xcframework and Cordova.xcframework from capacitor-swift-pm, checked through 8.4.2 and 9.0.0-alpha.6, both published mid-July 2026, are still built against Xcode 26.0/iOS 26.0. They haven’t been rebuilt against Xcode 26.6, which has been out for over a month.
  2. To work around that, we rebuilt Capacitor.framework and Cordova.framework ourselves from the open source 8.4.1 tag, compiled with current Xcode. That fixes ITMS-90111. It breaks something else: Apple’s SDK signature program requires “commonly used” SDKs to carry a signature that only the registered publisher, Drifty Co, can produce. The official binary carries one at the xcframework level, tied to Team ID 9YN2HU59K8. Our rebuild has none, since the signature is cryptographically bound to the exact compiled bytes of your release. A self-rebuild structurally can’t reproduce that no matter how closely it matches your source.
  3. We confirmed both failure modes cleanly and separately. Rebuilt frameworks (current SDK, no signature): ITMS-91065. Official 8.4.1 frameworks (valid signature, stale SDK): ITMS-90111, verbatim RC-requirement text, on a stable Xcode 26.6 host, so it’s not a host-machine issue.

Right now there’s no way to submit a compliant Capacitor iOS app. Current-SDK builds fail the signature check, signed builds fail the SDK-freshness check.

Ask: is there a release planned that rebuilds the xcframework binaries against a current Xcode/SDK while keeping the Apple SDK signature intact? Given how tightly Apple is enforcing this cycle, this seems likely to hit a lot of Capacitor apps soon if it hasn’t already. Happy to share test archives and logs if it helps reproduce this on your end.

Also filed as GitHub issue ionic-team/capacitor#8537, no response yet as of a day ago.

2

any news about this issue?