⬆️ native: pin 11.2.1 on both platforms so the Sentry fixes reach React Native apps

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Release Notes
 
+## 11.2.1 - August 14, 2026
+
+### Changed
+* Bump Android SDK to [v11.2.1](https://github.com/smileidentity/android-v11/releases/tag/v11.2.1)
+* Bump iOS SDK to [v11.2.1](https://github.com/smileidentity/ios/releases/tag/v11.2.1)
+
 ## 11.2.0 - August 7, 2026
 
 ### Changed

android/gradle.properties

@@ -3,5 +3,5 @@ SmileId_minSdkVersion=21
 SmileId_targetSdkVersion=36
 SmileId_compileSdkVersion=36
 SmileId_ndkversion=21.4.7075529
-SmileId_androidVersion=11.2.0
+SmileId_androidVersion=11.2.1
 SmileId_kotlinCompilerExtensionVersion=1.5.11

ios/RNSmileID.swift

@@ -11,7 +11,7 @@ class RNSmileID: NSObject {
     resolve: @escaping RCTPromiseResolveBlock,
     reject _: @escaping RCTPromiseRejectBlock
   ) {
-    SmileID.setWrapperInfo(name: .reactNative, version: "11.2.0")
+    SmileID.setWrapperInfo(name: .reactNative, version: "11.2.1")
 
     // Handle different initialization scenarios based on provided parameters
     if let apiKey = apiKey, let config = config {

osv-scanner.toml

@@ -1,116 +1,99 @@
 # OSV-Scanner allowlist for triaged advisories.
 #
-# All entries below are transitive devDependencies (release tooling, linters,
-# builders, test runners). None are shipped to consumers of this package.
-# Re-triage before ignoreUntil; either bump the direct dep that brings them in
-# or extend the date with updated justification.
+# Every entry below is a transitive devDependency — release tooling, the Metro
+# bundler, linters, builders, test runners — and none of them ship to consumers of
+# this package. Each one is here because a lockfile refresh cannot reach the fixed
+# version: the parent pins an exact version, the fix is a major upgrade of the
+# parent, or upstream has published no fix at all. The reason on each entry says
+# which.
+#
+# Re-triaged 2026-08-14: the previous window had lapsed, which is what turned this
+# gate red. Everything reachable by a lockfile refresh was fixed in that pass
+# instead of being listed here — 36 vulnerabilities across 15 packages, including
+# vm2 and both ws versions — so this file is now only the genuinely unreachable
+# remainder.
+#
+# Before ignoreUntil: re-triage. Either bump the direct dependency that brings the
+# advisory in, or extend the date with updated justification. Do not extend blindly
+# — check first whether a fix has since become reachable.
+
+# --- release-it 15 chain: fixes need release-it 16+, a major upgrade -------------
 
 [[IgnoredVulns]]
 id = "GHSA-h5c3-5r3r-rr8q"
-ignoreUntil = 2026-07-20
-reason = "Transitive via release-it@15 (@octokit/plugin-paginate-rest). Dev-only."
+ignoreUntil = 2026-11-14
+reason = "@octokit/plugin-paginate-rest 6.1.2 via release-it@15. Fix is 9.2.2, three majors on, unreachable without upgrading release-it. Dev-only."
 
 [[IgnoredVulns]]
 id = "GHSA-rmvr-2pp2-xj38"
-ignoreUntil = 2026-07-20
-reason = "Transitive via release-it@15 (@octokit/request). Dev-only."
+ignoreUntil = 2026-11-14
+reason = "@octokit/request 6.2.8 via release-it@15. Fix is 8.4.1, two majors on. Dev-only."
 
 [[IgnoredVulns]]
 id = "GHSA-xx4v-prfh-6cgc"
-ignoreUntil = 2026-07-20
-reason = "Transitive via release-it@15 (@octokit/request-error). Dev-only."
-
-[[IgnoredVulns]]
-id = "GHSA-2g4f-4pwh-qvx6"
-ignoreUntil = 2026-07-20
-reason = "Transitive via eslint/jest/commitlint (ajv). Dev-only."
-
-[[IgnoredVulns]]
-id = "GHSA-6v7q-wjvx-w8wg"
-ignoreUntil = 2026-07-20
-reason = "Transitive via release-it@15 -> webdav (basic-ftp). Dev-only."
-
-[[IgnoredVulns]]
-id = "GHSA-rp42-5vxx-qpwr"
-ignoreUntil = 2026-07-20
-reason = "Transitive via release-it@15 -> webdav (basic-ftp). Dev-only."
-
-[[IgnoredVulns]]
-id = "GHSA-f886-m6hf-6m8v"
-ignoreUntil = 2026-07-20
-reason = "Transitive (brace-expansion) across multiple dev deps. Dev-only."
-
-[[IgnoredVulns]]
-id = "GHSA-73rr-hh4g-fpgx"
-ignoreUntil = 2026-07-20
-reason = "Transitive via jest (diff). Dev-only."
-
-[[IgnoredVulns]]
-id = "GHSA-5j98-mcp5-4vw2"
-ignoreUntil = 2026-07-20
-reason = "Transitive (glob) across multiple dev deps. Dev-only."
+ignoreUntil = 2026-11-14
+reason = "@octokit/request-error 3.0.3 via release-it@15. Fix is 5.1.1, two majors on. Dev-only."
 
 [[IgnoredVulns]]
 id = "GHSA-2p57-rm9w-gvfp"
-ignoreUntil = 2026-07-20
-reason = "Transitive (ip@1.1.9) via release-it -> webdav. No fixed version available upstream; revisit when fix is published or dep is removed."
+ignoreUntil = 2026-11-14
+reason = "ip 1.1.9 via release-it@15 -> webdav. No fixed version published upstream. Dev-only."
 
 [[IgnoredVulns]]
-id = "GHSA-mh29-5h37-fv8m"
-ignoreUntil = 2026-07-20
-reason = "Transitive (js-yaml) across multiple dev deps. Dev-only."
+id = "GHSA-c2qf-rxjj-qqgw"
+ignoreUntil = 2026-11-14
+reason = "semver 7.3.8 and 7.5.1, pinned exactly by release-it@15 and @release-it/conventional-changelog, so a refresh cannot move them. Dev-only."
 
 [[IgnoredVulns]]
 id = "GHSA-f23m-r3pf-42rh"
-ignoreUntil = 2026-07-20
-reason = "Transitive via @release-it/conventional-changelog (lodash). Dev-only."
+ignoreUntil = 2026-11-14
+reason = "lodash 4.17.21, pinned exactly via @release-it/conventional-changelog. Fix is 4.18.0. Dev-only."
 
 [[IgnoredVulns]]
 id = "GHSA-r5fr-rjxr-66jc"
-ignoreUntil = 2026-07-20
-reason = "Transitive via @release-it/conventional-changelog (lodash). Dev-only."
+ignoreUntil = 2026-11-14
+reason = "lodash 4.17.21, pinned exactly via @release-it/conventional-changelog. Fix is 4.18.0. Dev-only."
 
-[[IgnoredVulns]]
-id = "GHSA-xxjr-mmjv-4gpg"
-ignoreUntil = 2026-07-20
-reason = "Transitive via @release-it/conventional-changelog (lodash). Dev-only."
+# --- Metro bundler: build-time only, no fix published ---------------------------
 
 [[IgnoredVulns]]
-id = "GHSA-23c5-xmqv-rm74"
-ignoreUntil = 2026-07-20
-reason = "Transitive (minimatch) across multiple dev deps. Dev-only."
+id = "GHSA-5p2g-fcmc-qvqq"
+ignoreUntil = 2026-11-14
+reason = "image-size 1.2.1 via metro 0.80.12 (React Native bundler). No fixed version published upstream. Build-time only."
 
 [[IgnoredVulns]]
-id = "GHSA-3ppc-4f35-3m26"
-ignoreUntil = 2026-07-20
-reason = "Transitive (minimatch) across multiple dev deps. Dev-only."
+id = "GHSA-w3rx-r6r6-pgpr"
+ignoreUntil = 2026-11-14
+reason = "image-size 1.2.1 via metro 0.80.12. No fixed version published upstream. Build-time only."
+
+# --- dev tooling where the fix is a major upgrade of the parent -----------------
 
 [[IgnoredVulns]]
-id = "GHSA-7r86-cg39-jmmj"
-ignoreUntil = 2026-07-20
-reason = "Transitive (minimatch) across multiple dev deps. Dev-only."
+id = "GHSA-mwp4-54f8-5fhr"
+ignoreUntil = 2026-11-14
+reason = "ip-address 9.0.5 via socks@^2.8.3. Fix is 10.x, a major the parent's range excludes. Dev-only."
 
 [[IgnoredVulns]]
-id = "GHSA-3v7f-55p6-f55p"
-ignoreUntil = 2026-07-20
-reason = "Transitive (picomatch) via dev deps. Dev-only."
+id = "GHSA-v2v4-37r5-5v8g"
+ignoreUntil = 2026-11-14
+reason = "ip-address 9.0.5 via socks@^2.8.3. Fix is 10.x, a major the parent's range excludes. Dev-only."
 
 [[IgnoredVulns]]
-id = "GHSA-c2c7-rcm5-vvqj"
-ignoreUntil = 2026-07-20
-reason = "Transitive (picomatch) via dev deps. Dev-only."
+id = "GHSA-52f5-9888-hmc6"
+ignoreUntil = 2026-11-14
+reason = "tmp 0.0.33 via external-editor and patch-package. Fix is 0.2.x, and a 0.x minor is a breaking change the ^0.0.33 range cannot take. Dev-only."
 
 [[IgnoredVulns]]
-id = "GHSA-c2qf-rxjj-qqgw"
-ignoreUntil = 2026-07-20
-reason = "Transitive (semver) across multiple dev deps. Dev-only."
+id = "GHSA-ph9p-34f9-6g65"
+ignoreUntil = 2026-11-14
+reason = "tmp 0.0.33 via external-editor and patch-package. Fix is 0.2.x, outside the ^0.0.33 range. Dev-only."
 
 [[IgnoredVulns]]
-id = "GHSA-52f5-9888-hmc6"
-ignoreUntil = 2026-07-20
-reason = "Transitive (tmp) via dev deps. Dev-only."
+id = "GHSA-3qcw-2rhx-2726"
+ignoreUntil = 2026-11-14
+reason = "turbo 1.13.4, a direct devDependency pinned ^1.10.7. Fix is 2.x, which changes turbo.json's schema (pipeline -> tasks), so it needs its own change. Build-time only."
 
 [[IgnoredVulns]]
-id = "GHSA-48c2-rrv3-qjmp"
-ignoreUntil = 2026-07-20
-reason = "Transitive (yaml) via dev deps. Dev-only."
+id = "GHSA-hcf7-66rw-9f5r"
+ignoreUntil = 2026-11-14
+reason = "turbo 1.13.4, a direct devDependency pinned ^1.10.7. Fix is 2.x, a schema-changing major. Build-time only."

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smile_identity/react-native",
-  "version": "11.2.0",
+  "version": "11.2.1",
   "description": "Official wrapper for the Smile ID >v10 android and iOS SDKs",
   "main": "lib/commonjs/index",
   "module": "lib/module/index",

react-native-smile-id.podspec

@@ -15,7 +15,7 @@ Pod::Spec.new do |s|
   s.source       = { :git => "https://docs.usesmileid.com/.git", :tag => "#{s.version}" }
 
   s.source_files = "ios/**/*.{h,m,mm,swift}"
-  s.dependency "SmileID", "11.2.0"
+  s.dependency "SmileID", "11.2.1"
   # for development alongside example/ios/Podfile uncomment the version and specify
   # tag or branch in example/ios/Podfile
   # s.dependency "SmileID"

sample/ios/Podfile.lock

@@ -2,11 +2,6 @@ PODS:
   - boost (1.83.0)
   - DoubleConversion (1.1.6)
   - FBLazyVector (0.74.2)
-  - FingerprintJS (1.6.0):
-    - FingerprintJS/Core (= 1.6.0)
-  - FingerprintJS/Core (1.6.0):
-    - FingerprintJS/SystemControl
-  - FingerprintJS/SystemControl (1.6.0)
   - fmt (9.1.0)
   - glog (0.3.5)
   - hermes-engine (0.74.2):
@@ -942,7 +937,7 @@ PODS:
     - React-debug
   - react-native-safe-area-context (4.14.1):
     - React-Core
-  - react-native-smile-id (11.2.0):
+  - react-native-smile-id (11.2.1):
     - DoubleConversion
     - glog
     - hermes-engine
@@ -962,7 +957,7 @@ PODS:
     - React-utils
     - ReactCommon/turbomodule/bridging
     - ReactCommon/turbomodule/core
-    - SmileID (= 11.2.0)
+    - SmileID (= 11.2.1)
     - Yoga
   - React-nativeconfig (0.74.2)
   - React-NativeModulesApple (0.74.2):
@@ -1215,18 +1210,11 @@ PODS:
     - ReactCommon/turbomodule/bridging
     - ReactCommon/turbomodule/core
     - Yoga
-  - Sentry (8.58.4):
-    - Sentry/Core (= 8.58.4)
-  - Sentry/Core (8.58.4)
-  - SmileID (11.2.0):
-    - SmileIDSDK (= 11.2.0)
-  - SmileIDSDK (11.2.0):
-    - FingerprintJS (= 1.6.0)
-    - Sentry (~> 8.57)
-    - ZIPFoundation (= 0.9.20)
+  - SmileID (11.2.1):
+    - SmileIDSDK (= 11.2.1)
+  - SmileIDSDK (11.2.1)
   - SocketRocket (0.7.0)
   - Yoga (0.0.0)
-  - ZIPFoundation (0.9.20)
 
 DEPENDENCIES:
   - boost (from `../node_modules/react-native/third-party-podspecs/boost.podspec`)
@@ -1291,12 +1279,9 @@ DEPENDENCIES:
 
 SPEC REPOS:
   trunk:
-    - FingerprintJS
-    - Sentry
     - SmileID
     - SmileIDSDK
     - SocketRocket
-    - ZIPFoundation
 
 EXTERNAL SOURCES:
   boost:
@@ -1419,7 +1404,6 @@ SPEC CHECKSUMS:
   boost: d3f49c53809116a5d38da093a8aa78bf551aed09
   DoubleConversion: 76ab83afb40bddeeee456813d9c04f67f78771b5
   FBLazyVector: 4bc164e5b5e6cfc288d2b5ff28643ea15fa1a589
-  FingerprintJS: 3a0c3e7f5035ecae199e5e5836200d9b20f1266a
   fmt: 4c2741a687cc09f0634a2e2c72a838b99f1ff120
   glog: fdfdfe5479092de0c4bdbebedd9056951f092c4f
   hermes-engine: 01d3e052018c2a13937aca1860fbedbccd4a41b7
@@ -1448,7 +1432,7 @@ SPEC CHECKSUMS:
   React-logger: 70e002e04cc56ff5c12157537405d1644c050703
   React-Mapbuffer: 8d1f0fc6e7280a8ed6da70ece5f283ac5c8032cb
   react-native-safe-area-context: 758e894ca5a9bd1868d2a9cfbca7326a2b6bf9dc
-  react-native-smile-id: 6c18567a82156af4caf4f928094d995d5c027264
+  react-native-smile-id: b2edb9bbe18672f50950b6c5c14799503199ca3e
   React-nativeconfig: 9f223cd321823afdecf59ed00861ab2d69ee0fc1
   React-NativeModulesApple: 1cd770ed7dc463e55d02a05f7fc3be46076d393e
   React-perflogger: 32ed45d9cee02cf6639acae34251590dccd30994
@@ -1473,12 +1457,10 @@ SPEC CHECKSUMS:
   React-utils: 08bb648cea0f37a0aa5df0c4f9ef50e5484ee0eb
   ReactCommon: 4968ff446d467c4def1945125e59f82e3e986af3
   RNScreens: 02747ebee17d2e322af4ee383877367cf82a3cd6
-  Sentry: 5321d74bdd28d6f6f8beaa1ca06f1fdc746bff49
-  SmileID: 848c46109ef664eae1491c78642b273e4a0997c5
-  SmileIDSDK: d4888e5df8039f2eec1f10a31c81bd681262d911
+  SmileID: 8a64fd13da9bd1a8b623496ad32d225b5d378583
+  SmileIDSDK: 022ac26d652546120578ec37675434289e315001
   SocketRocket: abac6f5de4d4d62d24e11868d7a2f427e0ef940d
   Yoga: ae3c32c514802d30f687a04a6a35b348506d411f
-  ZIPFoundation: dfd3d681c4053ff7e2f7350bc4e53b5dba3f5351
 
 PODFILE CHECKSUM: c75f928dd028b436fe16e4dfd48d42eb9de51e2a