The build server uses an allowlist system for Cordova plugins. Hence only plugins which have been specifically allowed can be used. This list is included at the end of this post.

Requesting new plugins

If you wish to use a plugin that isn't on the list file a new issue on the Construct 3 bug tracker with the NPM id of the plugin and the version you want added. As the allowlist is for specific version of plugins we also need notifying if you want to use a newer version of a plugin that is already on the list. All plugins are subject to a security review before being considered for the allowlist, and will only be included on the allowlist at the discretion of the reviewer.

Please test plugins work as intended before requesting to add them to the build service. We will not perform a security review of a plugin just so you can test if it works.

Review schedule

All plugin requests are subject to a security review, and we're a small team with limited time available for this. To help save time where possible, we will review requests on two schedules:

• Routine maintenance: regular patches and updates that are nice to have but not urgent. This includes entirely new plugin requests. These will be reviewed every 6-8 weeks.
• Urgent: something is currently broken right now and an update is necessary to fix it. This ought to be rare assuming the plugins are well-written, but accidents can happen. Urgent requests will be reviewed within 1-2 weeks (subject to staff availability).

Please indicate if your review request is urgent. Otherwise we will assume it is routine maintenance. Be sure to use the word "urgent" to indicate you are asking for this schedule.

Tips to speed up review

For security reasons, every dependency and sub-dependency of a Cordova plugin must be reviewed. It will be quicker to review a Cordova plugin, and more likely to be approved, if you take in to account the following tips:

• Prefer to use existing Cordova plugins, or if necessary submit patches to them, rather than forking an existing plugin. The less significant your change, the faster it will be reviewed. A full fork will take much longer to review and will be treated much more strictly in order to try to avoid having to maintain multiple forks of the same plugins. The only exception to this is if the fork removes a large amount of code and features that are not relevant to your purposes (as described in the next point).
• If you only need a few features of a larger Cordova plugin (particularly over-complicated "kitchen sink" plugins), consider forking it, publishing a stripped-down version with only the essentials you need, and then requesting that for the allowlist.
• Use the fewest possible dependencies. Only include dependencies that are strictly necessary. Having no dependencies at all is ideal. Note dependencies can be specified in package.json and with <dependency> and <framework> in plugin.xml.
• Make sure any dependencies are developed by reputable authors or organisations.
• Avoid complex build scripts, including <hook> in plugin.xml, .gradle files, and pre/post-install node scripts. If you have to use them, keep any such scripts as minimal and simple as possible. Complex hook or build scripts which cannot be proven to always be safe may result in rejection.

Referencing Cordova plugins

Cordova plugins are specified as dependencies of a Construct plugin. You can read how to specify a dependency of your Construct plugin in the Addon SDK documentation. While it is optional to set a version of a Cordova dependency we recommend choosing a specific version. This will ensure that if the API for the Cordova plugin changes it does not break your addon for users that are not up to date.

The allowlist does not effect Cordova project exports, as they do not go via the build server. You can always use any Cordova plugins without restriction if you do your own offline builds using the Cordova CLI.

Removal of old/unused Cordova plugins

The build service has been running for many years, and for security and maintenance reasons we intend to remove redundant or unused Cordova plugins. If the build service does not see any projects at all using a Cordova plugin for a period of six months, it may be removed from the allowlist. Likewise if old versions of a Cordova plugin are not used over the same period of time, the old versions may be removed from the allowlist while keeping the newer versions that are still in use.

If a Cordova plugin is not used at all over a period of six months, we do not expect removal to cause any significant disruption. We would prefer extremely rarely used Cordova plugins are not permitted on the build service and instead suggest that such cases are handled with offline builds using the Cordova CLI which has no restrictions on Cordova plugins. However if it turns out a removed Cordova plugin is in fact needed, you can request it is added again using the process above, although this should only be done be in cases where the plugin is expected to be used regularly again, and you should explain why this will be the case.

Current build server plugin allowlist

Below is the current list of supported plugins.

Last updated: November 5th 2024