@umutcansu/react-native-pinvault 2.6.0 → 2.7.0

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 2.7.0 — 2026-10-15
+
+### Changed
+
+- **Release builds take `tokenHosts` only from the native security file**,
+  as they already did `clientCertHosts`: where the file has the block but
+  names no `tokenHosts`, a `tokenHosts` from JS is refused
+  (`E_INVALID_CONFIG`, "declare tokenHosts for Config API … there"). The
+  library's default sends `PinVault-Token` to the block's own Config API only,
+  so a `tokenHosts` from JS would add hosts that receive the device's token.
+  Debug builds and files that name the hosts are unchanged. Move your
+  `tokenHosts` into `pinvault-security.json` (Android: `res/raw`, iOS: the
+  bundle) if a release build now refuses to start.
+
+## 2.6.1 — 2026-10-15
+
+### Fixed
+
+- **iOS: without `tokenHosts`, only the block's own Config API carries
+  `PinVault-Token`** (as Android has since 2.4.1). A block without
+  `tokenHosts` sent the token (and `PinVault-Proof`) to every host pinned by
+  its live config, so a pinned CDN or analytics host received it. Name your
+  API hosts in `tokenHosts` if they need the token.
+
+### Changed
+
+- Depends on PinVault 2.6.1 (Maven Central, Swift package tag `v2.6.1`).
+
 ## 2.6.0 — 2026-10-14
 
 ### Fixed

package/README.md

@@ -29,9 +29,9 @@ npm install @umutcansu/react-native-pinvault
 cd ios && pod install
 ```
 
-The native libraries come with it, at the package's own version: npm 2.6.0
-uses `io.github.umutcansu:pinvault:2.6.0` from Maven Central and the Swift
-package at tag `v2.6.0`. The New Architecture must stay on (React Native's
+The native libraries come with it, at the package's own version: npm 2.7.0
+uses `io.github.umutcansu:pinvault:2.7.0` from Maven Central and the Swift
+package at tag `v2.7.0`. The New Architecture must stay on (React Native's
 default since 0.76).
 
 **iOS.** The pod depends on the PinVault Swift package through React Native's
@@ -273,9 +273,10 @@ parsed as strictly; a broken file rejects `start` with `E_INVALID_CONFIG`
 - a block's `url`, `enrollmentUrl`, `renewalUrl`, `tokenHosts` and
   `clientCertHosts` are fixed where the file gives them (where the block talks to, and who gets its token and identity),
   and `attestation: true` / `proofOfPossession: true` there cannot be turned off from JS;
-  in a release build JS may give `clientCertHosts` only where the file names
-  them (the bundle cannot hand the device's identity to another host;
-  `tokenHosts` from JS only narrows the library's default);
+  in a release build JS may give `clientCertHosts` and `tokenHosts` only where
+  the file names them (the bundle cannot hand the device's identity or its
+  `PinVault-Token` to another host; the library's default sends the token to the
+  block's own Config API only);
 - `require` only tightens: a protection it turns on stays on whatever JS says,
   its `requireCaTrust` hosts are added to JS's, the expected signer / bundle /
   team ids and iOS `userAuthStrength` are fixed, and `expiredConfigGraceSeconds`

package/RNPinVault.podspec

@@ -4,7 +4,7 @@ package = JSON.parse(File.read(File.join(__dir__, "package.json")))
 
 # PinVault for iOS is a Swift package (Package.swift at the repository root,
 # product "PinVault"). React Native's spm_dependency adds it to the Pods project:
-#   - consumers: the git URL at the tag of this package's version (v2.6.0);
+#   - consumers: the git URL at the tag of this package's version (v2.7.0);
 #   - development: PINVAULT_IOS_PACKAGE_PATH = a PinVault checkout (the sample's
 #     Podfile sets it to this repository), the counterpart of pinvault.localPath.
 pinvault_url = "https://github.com/umutcansu/PinVault.git"

package/android/build.gradle

@@ -9,7 +9,7 @@ buildscript {
     kotlinVersion: "2.2.0",
     minSdkVersion: 24,
     compileSdkVersion: 36,
-    pinvaultVersion: "2.6.0",
+    pinvaultVersion: "2.7.0",
   ]
   ext.pinvaultRnExt = { prop ->
     rootProject.ext.has(prop) ? rootProject.ext.get(prop) : PinVaultRN[prop]

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/ConfigParser.kt

@@ -286,11 +286,18 @@ internal object ConfigParser {
             throw BridgeInputException("${b.path}.proofOfPossession: the app's native security file turns it on; JS cannot turn it off")
         }
         val proof = jsProof == true || nativeBlock?.proofOfPossession == true
+        // Who gets the device's token is the file's call in a release build, like the identity
+        // below: the library's default is the block's own Config API only, so a tokenHosts from
+        // JS would ADD hosts that receive the token.
+        if (release && nativeBlock != null && nativeBlock.tokenHosts == null && jsTokenHosts != null) {
+            throw BridgeInputException("${b.path}.tokenHosts: a release build takes it only from the app's native security file " +
+                "(${native?.source}); declare tokenHosts for Config API '$id' there")
+        }
         val tokenHosts = nativeBlock?.tokenHosts?.also { n ->
             if (jsTokenHosts != null && !NativeSecurity.sameKeys(jsTokenHosts.map(String::lowercase), n.map(String::lowercase))) fixed("tokenHosts")
         } ?: jsTokenHosts
         // Who gets the device's identity is the file's call in a release build: JS cannot
-        // add a host the file does not name (tokenHosts only narrows the library's default).
+        // add a host the file does not name.
         if (release && nativeBlock != null && nativeBlock.clientCertHosts == null && clientCertHosts != null) {
             throw BridgeInputException("${b.path}.clientCertHosts: a release build takes it only from the app's native security file " +
                 "(${native?.source}); declare clientCertHosts for Config API '$id' there")

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/NativeSecurity.kt

@@ -50,7 +50,9 @@ import java.io.IOException
  *   JS are refused unless the file allows them for that block;
  * - `url`, `tokenHosts` and `clientCertHosts` of a block are fixed where the
  *   file gives them, and `attestation: true` / `proofOfPossession: true` there
- *   cannot be switched off;
+ *   cannot be switched off; in a release build JS may give `tokenHosts` and
+ *   `clientCertHosts` only where the file names them (who gets the device's
+ *   token and identity is the file's call);
  * - `require` only tightens: a protection it turns on stays on whatever JS
  *   says, `requireCaTrust` hosts are added to JS's, `expectedSignerSha256` is
  *   fixed, and `expiredConfigGraceSeconds` is the most JS may ask for;

package/ios/Core/ConfigParser.swift

@@ -295,6 +295,13 @@ public enum ConfigParser {
         }
         let proof = jsProof == true || nativeBlock?.proofOfPossession == true
         let lower: ([String]) -> [String] = { $0.map { $0.lowercased() } }
+        // Who gets the device's token is the file's call in a release build, like the identity
+        // below: the library's default is the block's own Config API only, so a tokenHosts from
+        // JS would ADD hosts that receive the token.
+        if release, let nativeBlock, nativeBlock.tokenHosts == nil, jsTokenHosts != nil {
+            throw BridgeInputError("\(b.path).tokenHosts: a release build takes it only from the app's native security file "
+                + "(\(native?.source ?? "")); declare tokenHosts for Config API '\(id)' there")
+        }
         var tokenHosts = jsTokenHosts
         if let n = nativeBlock?.tokenHosts {
             if let j = jsTokenHosts, !NativeSecurity.sameKeys(lower(j), lower(n)) { throw fixed("tokenHosts") }
@@ -311,7 +318,7 @@ public enum ConfigParser {
             fixedRenewalUrl = n
         }
         // Who gets the device's identity is the file's call in a release build: JS cannot
-        // add a host the file does not name (tokenHosts only narrows the library's default).
+        // add a host the file does not name.
         if release, let nativeBlock, nativeBlock.clientCertHosts == nil, clientCertHosts != nil {
             throw BridgeInputError("\(b.path).clientCertHosts: a release build takes it only from the app's native security file "
                 + "(\(native?.source ?? "")); declare clientCertHosts for Config API '\(id)' there")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@umutcansu/react-native-pinvault",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "description": "PinVault for React Native: dynamic certificate pinning with signed remote configs, mTLS enrollment and signed vault files, as a thin bridge over the native PinVault libraries",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",