@umutcansu/react-native-pinvault 2.8.0 → 2.8.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 2.8.1 — 2026-10-15
+
+### Changed
+
+- **iOS: a pinned session notices when its trust check was skipped.** The
+  generic certificate-validation killers answer URLSession's server-trust
+  challenge before the library's delegate; such a connection is now refused
+  (`fetch` rejects with an SSL handshake error), a `wss://` socket cancelled,
+  and the host reported as `hooking_framework` evidence `tls-unverified:<host>`.
+  Depends on PinVault 2.8.1 (Swift package tag `v2.8.1`).
+
 ## 2.8.0 — 2026-10-15
 
 ### Changed

package/README.md

@@ -29,9 +29,9 @@ npm install @umutcansu/react-native-pinvault
 cd ios && pod install
 ```
 
-The native libraries come with it, at the package's own version: npm 2.8.0
-uses `io.github.umutcansu:pinvault:2.8.0` from Maven Central and the Swift
-package at tag `v2.8.0`. The New Architecture must stay on (React Native's
+The native libraries come with it, at the package's own version: npm 2.8.1
+uses `io.github.umutcansu:pinvault:2.8.1` from Maven Central and the Swift
+package at tag `v2.8.1`. The New Architecture must stay on (React Native's
 default since 0.76).
 
 **iOS.** The pod depends on the PinVault Swift package through React Native's
@@ -265,7 +265,7 @@ parsed as strictly; a broken file rejects `start` with `E_INVALID_CONFIG`
   with `E_INVALID_CONFIG` naming the field;
 - in a release build a declared block must carry its anchors: `bootstrapPins`
   (or `allowUnpinnedConfigApi`), `signaturePublicKeys` (or `allowUnsigned`) and
-  its `url` (2.7.1+: the device's token and identity go there); a block that
+  its `url` (2.8.0+: the device's token and identity go there); a block that
   only names itself rejects `start` — otherwise the bundle would supply them;
 - `allowUnsigned`, `allowUnpinnedConfigApi` and `allowServerGeneratedKey` from
   JS are refused unless the file allows them for that block; a release build
@@ -275,13 +275,13 @@ parsed as strictly; a broken file rejects `start` with `E_INVALID_CONFIG`
 - a block's `url`, `enrollmentUrl`, `renewalUrl`, `tokenHosts` and
   `clientCertHosts` are fixed where the file gives them (where the block talks to, and who gets its token and identity),
   and `attestation: true` / `proofOfPossession: true` there cannot be turned off from JS;
-  in a release build JS may give `enrollmentUrl`, `renewalUrl` (2.7.1+),
+  in a release build JS may give `enrollmentUrl`, `renewalUrl` (2.8.0+),
   `clientCertHosts` and `tokenHosts` only where the file names them (the bundle
   cannot hand the device's identity or its `PinVault-Token` to another host; the
   library presents the identity to the block's url, enrollment and renewal
   addresses, and its default sends the token to the block's own Config API only);
 - iOS `ios.resolve` (where a pinned host's connection goes) is fixed where the
-  file gives it, and a release build takes it only from the file (2.7.1+);
+  file gives it, and a release build takes it only from the file (2.8.0+);
 - `require` only tightens: a protection it turns on stays on whatever JS says,
   its `requireCaTrust` hosts are added to JS's, the expected signer / bundle /
   team ids and iOS `userAuthStrength` are fixed, and `expiredConfigGraceSeconds`
@@ -462,7 +462,10 @@ as one more signal. The decisive check is server-side attestation
 - **NETWORK** — pinned native path only; no unpinned fallback; `https` → `http`
   redirects are not followed; RN's own fetch / XHR / images / WebSocket are pinned on
   both platforms, fail closed before `start`, and a replaced
-  hook is detected.
+  hook is detected. On iOS (2.8.1+) a TLS connection whose certificate never
+  reached the library's check (an "SSL kill switch" tweak answered it first) is
+  refused and reported in the attestation report (`hooking_framework`,
+  `tls-unverified:<host>`).
 - **Trust anchors** — release builds take the relaxations only from the native
   security file; with the file, JS cannot change pins, keys or scopes.
 - **STORAGE** — the plugin stores nothing in JS (no AsyncStorage); tokens live

package/RNPinVault.podspec

@@ -4,7 +4,7 @@ package = JSON.parse(File.read(File.join(__dir__, "package.json")))
 
 # PinVault for iOS is a Swift package (Package.swift at the repository root,
 # product "PinVault"). React Native's spm_dependency adds it to the Pods project:
-#   - consumers: the git URL at the tag of this package's version (v2.8.0);
+#   - consumers: the git URL at the tag of this package's version (v2.8.1);
 #   - development: PINVAULT_IOS_PACKAGE_PATH = a PinVault checkout (the sample's
 #     Podfile sets it to this repository), the counterpart of pinvault.localPath.
 pinvault_url = "https://github.com/umutcansu/PinVault.git"

package/android/build.gradle

@@ -9,7 +9,7 @@ buildscript {
     kotlinVersion: "2.2.0",
     minSdkVersion: 24,
     compileSdkVersion: 36,
-    pinvaultVersion: "2.8.0",
+    pinvaultVersion: "2.8.1",
   ]
   ext.pinvaultRnExt = { prop ->
     rootProject.ext.has(prop) ? rootProject.ext.get(prop) : PinVaultRN[prop]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@umutcansu/react-native-pinvault",
-  "version": "2.8.0",
+  "version": "2.8.1",
   "description": "PinVault for React Native: dynamic certificate pinning with signed remote configs, mTLS enrollment and signed vault files, as a thin bridge over the native PinVault libraries",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",