expo-iap 5.3.1 → 5.3.2

package/ios/ExpoIapLog.swift

@@ -109,7 +109,7 @@ enum ExpoIapLog {
     }
 
     private static func sanitize(_ value: Any?) -> Any? {
-        guard let value else { return nil }
+        guard let value, !(value is NSNull) else { return nil }
 
         if let string = value as? String {
             let trimmed = string.trimmingCharacters(in: .whitespacesAndNewlines)
@@ -121,20 +121,20 @@ enum ExpoIapLog {
             return sanitize(json) ?? string
         }
 
-        if let dictionary = value as? [String: Any] {
-            return sanitizeDictionary(dictionary)
-        }
-
         if let optionalDictionary = value as? [String: Any?] {
             var compact: [String: Any] = [:]
             for (key, optionalValue) in optionalDictionary {
-                if let optionalValue {
+                if let optionalValue, !(optionalValue is NSNull) {
                     compact[key] = optionalValue
                 }
             }
             return sanitizeDictionary(compact)
         }
 
+        if let dictionary = value as? [String: Any] {
+            return sanitizeDictionary(dictionary)
+        }
+
         if let array = value as? [Any] {
             return array.compactMap { sanitize($0) }
         }

package/ios/onside/OnsideIapModule.swift

@@ -651,7 +651,7 @@ public final class ExpoIapOnsideModule: Module {
         }
     }
 
-    private func resolveSku(from request: RequestPurchaseProps) throws -> String {
+    nonisolated private func resolveSku(from request: RequestPurchaseProps) throws -> String {
         let sku: String?
         switch (request.type, request.request) {
         case (.inApp, .purchase(let platforms)):

package/openiap-versions.json

@@ -1,5 +1,5 @@
 {
   "spec": "3.2.1",
-  "google": "3.3.1",
+  "google": "3.3.2",
   "apple": "3.2.1"
 }

package/osv-scanner.toml

@@ -0,0 +1,9 @@
+[[IgnoredVulns]]
+id = "GHSA-5p2g-fcmc-qvqq"
+ignoreUntil = 2026-09-14
+reason = "No patched image-size release exists; Metro uses it only during trusted local builds."
+
+[[IgnoredVulns]]
+id = "GHSA-w3rx-r6r6-pgpr"
+ignoreUntil = 2026-09-14
+reason = "No patched image-size release exists; Metro uses it only during trusted local builds."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-iap",
-  "version": "5.3.1",
+  "version": "5.3.2",
   "description": "In App Purchase module in Expo",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -59,14 +59,17 @@
     "eslint-config-expo": "^57.0.1",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.5.6",
+    "expo": "^57.0.12",
     "expo-module-scripts": "^56.0.3",
     "expo-modules-core": "^57.0.10",
     "globals": "^17.9.0",
     "husky": "^9.1.7",
     "jest": "^29.7.0",
     "react": "19.2.3",
+    "react-native": "0.86.2",
     "test-renderer": "^1.2.0",
-    "ts-jest": "^29.4.12"
+    "ts-jest": "^29.4.12",
+    "typescript": "^5.9.2"
   },
   "peerDependencies": {
     "@amazon-devices/keplerscript-appstore-iap-lib": "~2.13.0",
@@ -83,6 +86,9 @@
       "optional": true
     }
   },
+  "overrides": {
+    "uuid": "11.1.1"
+  },
   "expo": {
     "plugin": "./app.plugin.js"
   }

package/plugin/build/withVega.js

@@ -42,6 +42,9 @@ const GENERATED_JS_MARKER = '// @generated by expo-iap';
 const DEFAULT_ICON_FILE = 'icon.png';
 const DEFAULT_BUILD_TYPE = 'Release';
 const DEFAULT_RUNTIME_MODULE = '/com.amazon.kepler.keplerscript.runtime.loader_2@IKeplerScript_2_0';
+// Vega SDK 0.24 requires both the OS module and an [os.version] block.
+const VEGA_OS_MODULE = '/com.amazon.vega.os@IVega_1_2';
+const VEGA_OS_VERSION = '1.2';
 const logOnce = (() => {
     const printed = new Set();
     return (msg) => {
@@ -133,6 +136,13 @@ id = "/com.amazon.iap.core@IIAPCoreUI"
 [needs]
 [[needs.module]]
 id = "/com.amazon.kepler.appstore.iap.purchase.core@IAppstoreIAPPurchaseCoreService"
+
+[[needs.module]]
+id = ${escapeTomlString(VEGA_OS_MODULE)}
+
+[os.version]
+target = ${escapeTomlString(VEGA_OS_VERSION)}
+min = ${escapeTomlString(VEGA_OS_VERSION)}
 `;
 exports.createVegaManifest = createVegaManifest;
 const createVegaEntryPoint = () => `${GENERATED_JS_MARKER}

package/plugin/src/withVega.ts

@@ -13,6 +13,9 @@ const DEFAULT_ICON_FILE = 'icon.png';
 const DEFAULT_BUILD_TYPE = 'Release';
 const DEFAULT_RUNTIME_MODULE =
   '/com.amazon.kepler.keplerscript.runtime.loader_2@IKeplerScript_2_0';
+// Vega SDK 0.24 requires both the OS module and an [os.version] block.
+const VEGA_OS_MODULE = '/com.amazon.vega.os@IVega_1_2';
+const VEGA_OS_VERSION = '1.2';
 
 const logOnce = (() => {
   const printed = new Set<string>();
@@ -155,6 +158,13 @@ id = "/com.amazon.iap.core@IIAPCoreUI"
 [needs]
 [[needs.module]]
 id = "/com.amazon.kepler.appstore.iap.purchase.core@IAppstoreIAPPurchaseCoreService"
+
+[[needs.module]]
+id = ${escapeTomlString(VEGA_OS_MODULE)}
+
+[os.version]
+target = ${escapeTomlString(VEGA_OS_VERSION)}
+min = ${escapeTomlString(VEGA_OS_VERSION)}
 `;
 
 export const createVegaEntryPoint = (): string => `${GENERATED_JS_MARKER}

package/tests/ios/ExpoIapLogTests.swift

@@ -0,0 +1,37 @@
+import XCTest
+
+final class ExpoIapLogTests: XCTestCase {
+    override func tearDown() {
+        ExpoIapLog.setHandler(nil)
+        super.tearDown()
+    }
+
+    @objc func testNullSensitiveValuesAreOmittedAndPresentValuesAreMasked() {
+        var output = ""
+        ExpoIapLog.setEnabled(true)
+        ExpoIapLog.setHandler { _, message in output = message }
+
+        let payload: [String: Any?] = [
+            "purchaseToken": nil,
+            "userIdAmazon": NSNull(),
+            "apiKey": "known-api-key",
+        ]
+        ExpoIapLog.payload("requestPurchase", payload: payload)
+
+        XCTAssertFalse(output.contains("purchaseToken"))
+        XCTAssertFalse(output.contains("userIdAmazon"))
+        XCTAssertTrue(output.contains("\"apiKey\":\"hidden\""))
+        XCTAssertFalse(output.contains("known-api-key"))
+    }
+}
+
+@main
+private enum ExpoIapLogTestRunner {
+    static func main() {
+        let test = ExpoIapLogTests(
+            selector: #selector(ExpoIapLogTests.testNullSensitiveValuesAreOmittedAndPresentValuesAreMasked)
+        )
+        test.run()
+        precondition(test.testRun?.hasSucceeded == true)
+    }
+}