Repository navigation
⬆️ native: pin 11.2.1 on both platforms so the Sentry fixes reach React Native apps - #240
Conversation
Picks up the 11.2.1 native releases, which close out the Sentry backlog: the capture crashes, the submission races and the startup ANRs on Android, and the SmartSelfie result decode failure on iOS. Both platforms move together, so neither side ships against an older SDK than the other.
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
🔍 Semgrep Security Scan Results✅ No security findings detected by |
PR Code Suggestions ✨No code suggestions found for the PR. |
|
Heads up on the iOS check: it fails on That is the expected state, not a problem with this change. The Re-run the iOS job after that and it should resolve 11.2.1. The Android side is unaffected — |
Bumps the package version and the wrapper version reported to the native SDKs through setWrapperInfo, which is hardcoded alongside it, and dates the release notes.
|
The |
The lock recorded SmileID 11.2.0, which CocoaPods treats as binding, so pod install refused the podspec's 11.2.1. Regenerated with pod update. SmileIDSDK 11.2.1 no longer declares FingerprintJS, Sentry or ZIPFoundation — they were phantom declarations for code the xcframework already embeds — so those three leave the pod graph here too.
The OSV scan has been failing on main as well, on ten advisories against three transitive packages: vm2 3.11.3 (eight, up to CVSS 10.0) and ws at 6.2.3 and 7.5.10. Every patched version already satisfied the ranges the tree asks for (vm2 ^3.9.19 via degenerator, ws ^6.2.2 and ^7.5.10), so the lock was simply stale rather than pinned to something vulnerable. Refreshed those descriptors only — vm2 3.11.5, ws 6.2.6 and 7.5.13 — with no change to package.json.
|
Fixed the It was ten OSV advisories against three transitive packages — This is unrelated to the 11.2.1 bump and was failing on |
|
Correcting my previous comment: I read only the tail of the scanner's table, so "ten advisories against three packages" understated it badly. The real numbers, before and after this change:
So the refresh is a real improvement — 12 vulnerabilities and 5 criticals gone — but it does not make this check green, and I should not have implied it would. What is left splits cleanly: 14 packages have a patched version inside the range the tree already asks for ( 5 need a major upgrade of the package that pulls them, so no lock refresh can reach them: That last group is a dependency-upgrade decision, which this repo's AGENTS.md puts behind "ask first", and it is unrelated to a native pin bump. I would rather not grow a release PR into a toolchain upgrade. Worth noting for the merge decision: this check is not in the branch's required-status list (that list is empty; only one approving review is required), and it fails on |
The gate turned red because every entry in osv-scanner.toml carried ignoreUntil = 2026-07-20 and that window lapsed 25 days ago — not because new advisories appeared. The file's own instructions say to re-triage at that point, so this does both halves of it. Fixed for real, by refreshing lockfile entries whose patched version already satisfied the range the tree asks for: @babel/core, ajv, brace-expansion, diff, fast-uri, joi, js-yaml, lodash, minimatch, nanoid, semver, shell-quote, tar and tmp — 36 vulnerabilities across 15 packages, on top of the earlier vm2 and ws refresh. package.json is untouched; only resolutions moved. What remains is genuinely unreachable that way, and each entry now records which case it is: an exact pin by the parent (semver 7.3.8/7.5.1, lodash 4.17.21), a 0.x range that cannot take the fix (tmp), a major upgrade of the parent (@octokit via release-it@15, ip-address via socks, turbo 1.x), or no published fix at all (ip, image-size via Metro). All are devDependencies and none ship to consumers. Verified with osv-scanner 2.5.0 locally, the same version CI pins: 64 vulnerabilities before, "No issues found" after.
2 participants
User description
Story: N/A — native pin bump
Summary
Picks up the 11.2.1 native SDKs. That release closes out the Sentry backlog: on Android the
capture crashes, the submission races and the startup ANRs; on iOS the SmartSelfie result decode
failure that was the largest single source of errors by volume.
Both platforms move in the same change, so neither side ships against an older SDK than the other.
This also cuts the wrapper release:
package.jsonmoves to 11.2.1, matching the native version.Verified the pinned artifacts exist rather than assuming:
com.smileidentity:android-sdk:11.2.1resolves from Maven Central.smileidentity/iosv11.2.1tag and its release assets exist.Known Issues
SmileIDpod for 11.2.1 is not on Trunk yet, so any job that runspod installwill fail until it lands. That is not a problem with this change. The per-version
SmileIDSDKspec is already published, and
SmileIDis pushed by a separate workflow once Trunk's aggregateindex catches up — it lags the per-version spec by 30 minutes to several hours by design,
because
SmileIDdeclares an exact dependency onSmileIDSDK. Re-run the checks after that,and this goes green on its own.
Podfile.lockfiles still resolve 11.2.0. They have to be regenerated withpod installonce the pod is available, which cannot be done from this change.android/gradle.properties(SmileId_androidVersion) andreact-native-smile-id.podspecboth move.
ios/RNSmileID.swiftreports the wrapper version throughsetWrapperInfoas a hardcoded string,so it moves to 11.2.1 with
package.json. The Android side reads the version frompackage.jsonat build time and needs no edit.
Test Instructions
The iOS side needs the pod on Trunk first; after that,
cd sample/ios && pod install.Screenshot
N/A — no UI changes.
PR Type
Other
Description
Pin iOS
SmileIDpod to 11.2.1Pin Android SDK version to 11.2.1
Add unreleased CHANGELOG entry for both bumps
Diagram Walkthrough
File Walkthrough
react-native-smile-id.podspec
Bump iOS SmileID pod to 11.2.1react-native-smile-id.podspec
SmileIDpod dependency from 11.2.0 to 11.2.1gradle.properties
Bump Android native SDK version to 11.2.1android/gradle.properties
SmileId_androidVersionfrom 11.2.0 to 11.2.1, the defaultAndroid native SDK pin
CHANGELOG.md
Document the 11.2.1 native bumpsCHANGELOG.md
Unreleasedsection withChangedbullets