I think updating js without review is also against policy.
App Review Guidelines §2.5.2 says: "Apps should be self-contained in their bundles, and may not read or write data outside the designated container area, nor may they download, install, or execute code which introduces or changes features or functionality of the app, including other apps"
Technically Apple can punish you for anything but so far it seems to be accepted for small fixes and tweaks.
It’s a grey area for other parts of the code that are not mentioned in the text.
It’s grey for other parts of the code that are not mentioned in the text.