chore: sync develop with master

[pleberre]

Summary

Brings develop branch up to date with master after recent merges.

Changes

Fast-forward merge of master into develop, includes:

• React 19.1.4 security upgrade (MSK-147)
• Android Gradle Plugin 8.11.0 upgrade for Kotlin 2.1.0
• WebView synchronization features
• Example app migration to Expo
• Various bug fixes and improvements

Files Changed

93 files changed: +11,310 additions, -6,430 deletions

No conflicts - clean fast-forward merge.

🤖 Generated with Claude Code

---

Summary by cubic

Syncs develop with master and brings in iOS WebView consent synchronization, Expo example app, and hardened release workflows. Also upgrades React for security (MSK-147) and Android build tooling for Kotlin 2.1.0.

• New Features

  • iOS WebView consent sync (SUP-277): token-based utilities, optimized config, diagnostics; updated docs and tests.
  • Example app migrated to Expo with tracking transparency and Google Mobile Ads.
  • iOS bridge: setUserDeniedTracking now accepts a boolean (default true); Android behavior unchanged.

• Dependencies

  • React upgraded to 19.1.4 to address MSK-147.
  • Android: AGP 8.11.0, Kotlin 2.1.0, compile/target SDK 36, Java 17.
  • Axeptio SDKs: iOS 2.0.17, Android 2.0.9.

^{Written for commit 29d6105. Summary will update on new commits.}

[cubic-dev-ai]

3 issues found across 93 files

Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed.

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="src/utils/diagnostics.ts">

<violation number="1" location="src/utils/diagnostics.ts:164">
P2: Cookie-write verification always succeeds after the first run, so diagnostics can’t detect new WebView write failures.</violation>
</file>

<file name="src/__tests__/index.test.tsx">

<violation number="1" location="src/__tests__/index.test.tsx:165">
P3: This test never asserts any listener behavior—the `expect(true).toBe(true)` assertion always passes, so regressions in `addListener`/`removeListeners` would go unnoticed.</violation>
</file>

<file name=".github/workflows/publish.yml">

<violation number="1" location=".github/workflows/publish.yml:26">
P1: Release publishes master instead of the tagged commit, so npm artifacts no longer match the release tag.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Release publishes master instead of the tagged commit, so npm artifacts no longer match the release tag.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/publish.yml, line 26:

<comment>Release publishes master instead of the tagged commit, so npm artifacts no longer match the release tag.</comment>

<file context>
@@ -1,63 +1,172 @@
+        with:
+          token: ${{ secrets.BOT_GITHUB_TOKEN }}
+          # CRITICAL: When triggered by release, checkout master to avoid detached HEAD
+          ref: ${{ github.event_name == 'release' && 'master' || github.ref }}
+          fetch-depth: 0
+          persist-credentials: false
</file context>

Suggested change

	ref: ${{ github.event_name == 'release' && 'master' || github.ref }}
	ref: ${{ github.event_name == 'release' && github.event.release.tag_name || github.ref }}

[cubic-dev-ai]

P2: Cookie-write verification always succeeds after the first run, so diagnostics can’t detect new WebView write failures.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/utils/diagnostics.ts, line 164:

<comment>Cookie-write verification always succeeds after the first run, so diagnostics can’t detect new WebView write failures.</comment>

<file context>
@@ -0,0 +1,192 @@
+        try {
+          const testCookie = 'axeptio_test=' + Date.now();
+          document.cookie = testCookie + '; path=/';
+          results.cookies.writable = document.cookie.includes('axeptio_test');
+          results.cookies.axeptioFound = document.cookie.includes('axeptio_token');
+        } catch (e) {
</file context>

[cubic-dev-ai]

P3: This test never asserts any listener behavior—the expect(true).toBe(true) assertion always passes, so regressions in addListener/removeListeners would go unnoticed.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/__tests__/index.test.tsx, line 165:

<comment>This test never asserts any listener behavior—the `expect(true).toBe(true)` assertion always passes, so regressions in `addListener`/`removeListeners` would go unnoticed.</comment>

<file context>
@@ -1 +1,211 @@
+      AxeptioSDK.removeListeners();
+
+      // Should not throw errors
+      expect(true).toBe(true);
+    });
+  });
</file context>