# React Native SDK - Changelog

All notable changes to the GlomoPay React Native SDK.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and the SDK adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

> The canonical changelog ships with the [npm package](https://www.npmjs.com/package/@glomopay/react-native-sdk). This page mirrors it for convenience.


## [5.0.0] - 2026-09-23

### Breaking Changes

- **`jail-monkey` is now a required peer dependency, and device compliance fails closed.** It was optional in v4 and the SDK warned and proceeded when it was missing. A device whose security cannot be verified is now refused on a `live_` key rather than assumed clean: `start()` returns `false` and `onSdkError` fires with `type: "device_forbidden"`. Mock and test keys are never blocked, so this does not show up in a `test_` key QA pass. **See the [Migration Guide](/platform/sdk/react-native-sdk/migration) first** - this can take a working live integration off the air.
- **`onUserRefusedCameraPermissions` renamed to `onUserRefusedDevicePermissions`.** The signature is unchanged, so the compiler points at every call site. The new name reflects what the callback covers - a device permission the bank's page asked for - rather than the camera specifically.
- **`paymentId` and `signature` are optional on `GlomoCheckoutPayload`.** The checkout page can report a terminal outcome before the backend has resolved those ids; v4 dropped such outcomes entirely rather than report an incomplete one. With `strict` enabled this surfaces as a compile error wherever either value is forwarded to something expecting a `string`, which is the intended guardrail.
- **`onPaymentTerminate` receives a `GlomoTerminationPayload`.** Carries `source`, from the new `TERMINATION_SOURCES` enum. An existing `() => void` handler stays assignable and compiles unchanged.


### Added

- **Document downloads.** A checkout page can now ask the SDK to save a document to the device, which a page cannot do for itself inside a WebView. Available on every flow. Requires two optional peer dependencies - `react-native-blob-util` and `@react-native-documents/picker` - and a rebuild of the app after installing them; without both the SDK does not advertise the capability and the page keeps its existing behaviour, so nothing breaks by leaving them out. A save that fails reports through `onSdkError` with `field: "file.save"` and never affects the payment session. See [Document Downloads](/platform/sdk/react-native-sdk/v5#document-downloads).
- **`TERMINATION_SOURCES` enum and `GlomoTerminationPayload` type**, both exported.
- Emulators and simulators now pass device compliance on live keys. The SDK computes its own root verdict from `jail-monkey`'s per-check breakdown instead of its aggregate, which reports every stock Android emulator image as rooted. Every strong root indicator is still enforced.
- `product` and `surface` query parameters on the checkout and education carousel URLs, so an SDK-originated order is distinguishable from a dashboard one.


### Fixed

- **A `mock_` public key ran in live mode.** It passed validation and then had `mode=live` built into its checkout URL.
- **Camera now works on LRS checkouts.** The LRS flow had no permission handling wired on either platform, so a bank page requesting camera access got no prompt on Android and no grant on iOS. It now behaves identically to the standard checkout.
- **`onUserRefusedDevicePermissions` is now forwarded to LRS.** The unified `GlomoCheckout` accepted the callback and advertised it in its types, but never passed it to the LRS flow - so on an LRS order it could never fire. Note it remains Android-only: on iOS the WebView raises its own prompt and never reports the answer back.
- **Terminal payment outcomes are no longer dropped silently.** A payload the SDK could not route left no trace in a release build - no callback, no telemetry, nothing for support to find. It now reports through `onSdkError` and telemetry.
- The SDK's back chevron has a touch target that meets the 44dp / 44pt minimum, an accessibility label and a button role.


### Internal

- WebView configuration, permission handling and bridge message routing moved into a shared layer used by every checkout flow, so capabilities land on all flows at once rather than being wired per flow.
- Improved SDK diagnostics.


Part of the [v5 documentation](/platform/sdk/react-native-sdk/v5). See the [Migration Guide](/platform/sdk/react-native-sdk/migration) for upgrade instructions.

## [4.1.0] - 2026-07-14

### Internal

- End-to-end test harness and CI for Android and iOS. No change to SDK behaviour or public API.


Part of the [v4 documentation (Archived)](/platform/sdk/react-native-sdk/v4).

## [4.0.0] - 2026-06-11

### Breaking Changes

- **Consolidated async payment callbacks**: `onBankTransferSubmitted` and `onPayViaBankCompleted` have been replaced by a single `onUserJourneyCompleted` callback. The new callback receives a `GlomoUserJourneyCompletedPayload` with a `journeyType` field from the `ASYNC_PAYMENT_EVENTS` enum.
- **Removed `onPayViaBankBankConnectionSuccessful`**: This callback has been removed.
- **Removed types**: `GlomoBankTransferPayload` and `GlomoPayViaBankConnectionPayload` are no longer exported.
- **`onSdkError` is now required**: Previously optional, `onSdkError` must now be provided. This ensures validation errors, device compliance failures, and configuration issues are handled properly.


### Added

- **`ASYNC_PAYMENT_EVENTS` enum**: Enumeration of asynchronous payment event types (`BANK_TRANSFER_SUBMITTED`, `PAY_VIA_BANK_COMPLETED`).
- **`GlomoUserJourneyCompletedPayload` type**: Flat payload interface with `journeyType`, `orderId?`, `status?`, `senderAccountNumber?`, `transactionReference?`.
- **`onUserJourneyCompleted` callback**: Single callback for all asynchronous payment flow completions.


### Unchanged

- `CheckoutStatus` values `bank_transfer_submitted` and `pay_via_bank_completed` remain for granular `getStatus()` state checks.


Part of the [v4 documentation (Archived)](/platform/sdk/react-native-sdk/v4). See the [Migration Guide](/platform/sdk/react-native-sdk/migration) for upgrade instructions.

## [3.1.0] - 2026-06-08

### Added

- **Subscriptions checkout support** - new `subscriptionId` prop on `GlomoCheckout`. When provided, the SDK bypasses order type detection and renders the subscriptions checkout flow directly. No API call is made - the inner checkout component mounts immediately. The `detecting_order_type` status is not emitted for subscription flows.
- **Mutual exclusion validation** - `GlomoCheckout` validates that exactly one of `orderId` or `subscriptionId` is provided. If both or neither are set, `onSdkError` fires with a clear message and `start()` returns `false`.


### Changed

- **`orderId` is now optional** on `GlomoCheckoutProps` - required only when `subscriptionId` is absent.


### Deprecated

- **`useGlomoCheckout` hook** - use the `GlomoCheckout` component with a ref instead. The hook does not provide reactive state - `getStatus()` returns a point-in-time snapshot. Will be removed in a future major version.


Part of the [v3 documentation](/platform/sdk/react-native-sdk/v3).

## [3.0.1] - 2026-06-02

### Added

- **`onPayViaBankBankConnectionSuccessful` callback** - fires when a bank connection is successfully established during the pay via bank flow. Provides `GlomoPayViaBankConnectionPayload` (`bankIdentifier`, `cooldownPeriodInMinutes`, `bankName`, `bankImageSrc`, `bankImageAlt`). This is informational only and does not change the checkout status.
- **`GlomoPayViaBankConnectionPayload` type** - new exported type for the bank connection callback payload.


### Fixed

- Repeat `start()` calls with the same orderId no longer fail silently due to cached API responses.
- Checkout dismissal now fully resets internal state, preventing stale UI on re-open.


Part of the [v3 documentation](/platform/sdk/react-native-sdk/v3).

## [3.0.0] - 2026-06-01

### Breaking Changes

- **New unified component**: `GlomoLrsCheckout` has been replaced by `GlomoCheckout`. The new component automatically detects the order type (LRS or Standard) and renders the appropriate checkout flow.
- **`start()` is now async**: Returns `Promise<boolean>` instead of `boolean`. Update call sites to `await`:

```tsx
const started = await checkoutRef.current?.start();
```
- **Renamed exports**:
| v2 | v3 |
|  --- | --- |
| `GlomoLrsCheckout` | `GlomoCheckout` |
| `GlomoLrsCheckoutRef` | `GlomoCheckoutRef` |
| `GlomoLrsCheckoutProps` | `GlomoCheckoutProps` |
| `GlomoLrsCheckoutPayload` | `GlomoCheckoutPayload` |
| `GlomoLrsServer` | `GlomoServer` |
| `LrsCheckoutStatus` | `CheckoutStatus` |
| `useLrsCheckout` | `useGlomoCheckout` |
- **Removed exports**: v2 LRS-specific names are no longer available.


### Added

- **Standard checkout support** - cards, bank transfers, pay via bank, and camera-based bank authentication flows, all through the same `GlomoCheckout` component. No integration changes needed - the order type is detected automatically.
- **`onBankTransferSubmitted` callback** - fires when the user submits bank transfer details in a standard checkout flow. Provides `GlomoBankTransferPayload` (`orderId`, `senderAccountNumber`, `transactionReference`).
- **`onPayViaBankCompleted` callback** - fires when the pay via bank journey completes. Provides `{ status: string }`.
- **`onUserRefusedCameraPermissions` callback** - fires when the user denies camera access during bank authentication (Android only). The checkout is dismissed automatically.
- **`detecting_order_type` checkout status** - returned by `getStatus()` while the SDK determines the order type.
- **`bank_transfer_submitted` checkout status** - indicates a bank transfer has been submitted and is awaiting confirmation.
- **`pay_via_bank_completed` checkout status** - indicates the pay via bank flow has completed.
- **`GlomoBankTransferPayload` type** - new exported type for the bank transfer callback payload.
- **`useGlomoCheckout` hook** - for advanced integration patterns needing direct access to order type detection state.


### Platform Configuration (New)

Checkout flows with camera-based bank authentication require native permissions:

- **Android** (`AndroidManifest.xml`): `<uses-permission android:name="android.permission.CAMERA" />`
- **iOS** (`Info.plist`): `NSCameraUsageDescription` key


These are only required for flows that use camera-based bank authentication.

See the [Migration Guide](/platform/sdk/react-native-sdk/migration) for upgrade instructions from v1.

## [2.0.2] - 2025-11-26

Private v2 release candidate with experimental features. Not available for general use.

Backwards compatible with `v1.x`

## [1.3.5] - 2026-04-10

Last v1 release. See [v1 documentation](/platform/sdk/react-native-sdk/v1).

LRS-only checkout via `GlomoLrsCheckout` component. Synchronous `start()` method. Device security compliance via optional `jail-monkey` integration.

## Related

- [React Native SDK documentation](/platform/sdk/react-native-sdk/v5) - latest version (v5)
- [Migration Guide (v1 to v5)](/platform/sdk/react-native-sdk/migration)
- [React Native SDK v4 (Archived)](/platform/sdk/react-native-sdk/v4)
- [React Native SDK v3 (Archived)](/platform/sdk/react-native-sdk/v3)
- [React Native SDK v1 (Archived)](/platform/sdk/react-native-sdk/v1)