Release/2.28.1

[uc-brunosilva]

No description provided.

[codeant-ai]

Skipping CodeAnt AI review — this PR is a back-merge between long-lived branches (release/2.28.1 → master). The diff here has already been reviewed when the underlying commits landed on the source branch, so re-running analysis would produce duplicate findings on already-reviewed code.

If you want to analyze this anyway (e.g. you resolved conflicts with new logic), comment @codeant-ai : review and CodeAnt will start a review.

[coderabbitai]

Warning

Review limit reached

@uc-brunosilva, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 11 seconds

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 346cdbcb-c5e3-4418-ad4b-98920875f8b9

📥 Commits

Reviewing files that changed from the base of the PR and between fbca38d and 384efc2.

⛔ Files ignored due to path filters (2)

• package-lock.json is excluded by !**/package-lock.json
• sample/ios/Podfile.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• CHANGELOG.md
• android/build.gradle.kts
• package.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/2.28.1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Release 2.28.1: iOS Mediation CCPA fix + version bumps

🐞 Bug fix 📝 Documentation ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Publish 2.28.1 release notes for iOS Mediation AppLovin CCPA setDoNotSell fix.
• Bump SDK/package versions to 2.28.1 across Android, npm, and iOS sample.
• Refresh iOS sample Pod lockfile to align with 2.28.1 pods/checksums.

Diagram

graph TD
  V(["Release version 2.28.1"]) --> C["CHANGELOG.md"] --> P["package.json"] --> PL["package-lock.json"] --> A["android/build.gradle.kts"] --> I["sample/ios/Podfile.lock"]

Loading

High-Level Assessment

The PR follows the standard release workflow: record the fix in the changelog and bump the version consistently across npm, Android, and the iOS sample lockfile. No meaningfully better architectural alternative for a patch release; the main review focus should be verifying version consistency (2.28.1 everywhere) and ensuring the Podfile.lock corresponds to the intended pod versions.

Files changed (5) +73 / -69

Documentation (1) +4 / -0

CHANGELOG.mdAdd 2.28.1 release notes entry +4/-0

Add 2.28.1 release notes entry

• Adds the 2.28.1 section and documents an iOS Mediation fix for AppLovin CCPA 'setDoNotSell' incorrectly always passing 'YES'.

CHANGELOG.md

Other (4) +69 / -69

build.gradle.ktsBump Android Usercentrics version to 2.28.1 +1/-1

Bump Android Usercentrics version to 2.28.1

• Updates the 'usercentricsVersion' constant from 2.28.0 to 2.28.1 to align Android artifacts with the patch release.

android/build.gradle.kts

package-lock.jsonUpdate npm lockfile version to 2.28.1 +2/-2

Update npm lockfile version to 2.28.1

• Updates the package version fields in the lockfile from 2.28.0 to 2.28.1 to match the release.

package-lock.json

package.jsonBump npm and iOS package versions to 2.28.1 +2/-2

Bump npm and iOS package versions to 2.28.1

• Updates 'version' and 'iosPackageVersion' from 2.28.0 to 2.28.1 so published metadata matches the patch release.

package.json

Podfile.lockAlign iOS sample pods with 2.28.1 +64/-64

Align iOS sample pods with 2.28.1

• Updates the sample app lockfile to use 'react-native-usercentrics', 'Usercentrics', and 'UsercentricsUI' 2.28.1 and refreshes related spec checksums.

sample/ios/Podfile.lock

[pantoaibot]

PR Summary:

Release 2.28.1 — small patch: fixes AppLovin CCPA consent handling on iOS and updates release metadata/version numbers.

Changes:

• CHANGELOG.md: Added 2.28.1 (Jul 15, 2026) release notes documenting fix:
  • [iOS — Mediation] Fixed AppLovin CCPA setDoNotSell always passing YES regardless of actual consent.
• android/build.gradle.kts: Bumped usercentricsVersion from 2.28.0 to 2.28.1.
• package.json: Bumped package version and iosPackageVersion from 2.28.0 to 2.28.1.

Notes:

• No other code/API/behavior changes or dependency upgrades in this PR.
• Suggested review: verify iOS AppLovin mediation CCPA behavior and CI/package publishing metadata.

Reviewed by Panto AI

[pantoaibot]

Reviewed up to commit:384efc2b550a51de4b604756da4ace4da34dfb42

Additional Suggestion

Others

- The podspec uses package['version'] for s.version and package['iosPackageVersion'] for the UsercentricsUI dependency (see reference lines 6-36). Keeping two separate version fields in package.json is a duplication risk — consider deriving iosPackageVersion from package['version'] or centralizing version values to avoid accidental mismatch between the published npm package version and the iOS dependency version.

s.name         = package["iosPackageName"]
version        = package["version"]

s.version      = version
s.summary      = package["description"]
s.license      = package["license"]

s.authors      = package["author"]
s.homepage     = package["homepage"]
s.platform     = :ios, "11.0"

s.source       = { :path => "." }

s.source_files = "ios/**/*.{h,m,mm,swift}"

s.dependency "React-Core"
s.dependency "React-NativeModulesApple"
s.dependency "UsercentricsUI", version

Reviewed by Panto AI

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Podfile.lock checksum churn 🐞 Bug ⚙ Maintainability

Description

sample/ios/Podfile.lock updates SPEC CHECKSUMS for many external-source React Native pods (React-*,
react-native-webview, etc.), not just the Usercentrics-related entries, which creates a large noisy
diff and increases lockfile drift/merge-conflict risk. This should be verified as intentional by
reproducing the lockfile generation from a clean install (npm ci + pod install) and keeping only
necessary changes.

Code

sample/ios/Podfile.lock[R2825-2855]

+  React-Core: 7195661f0b48e7ea46c3360ccb575288a20c932c
+  React-CoreModules: 14f0054ab46000dd3b816d6528af3bd600d82073
+  React-cxxreact: 7f602425c63096c398dac13cd7a300efd7c281ae
  React-debug: d4955c86870792887ed695df6ebf0e94e39dc7e1
-  React-defaultsnativemodule: bd2b805c6daa85d430d034aa748544b377ada152
-  React-domnativemodule: b5c04a4a74ed9c3cb25adc72583b017868600464
-  React-Fabric: 93a9ff378f1edf29e9a22a24ad55a1be061e7985
-  React-FabricComponents: 83bd54366d4ecb8bec563aa1a78d49915763d503
-  React-FabricImage: 8bcd88e553047d4ed5c7ea3def8d6c0e3dd88cfc
-  React-featureflags: 4ea691ab154d505277859416aa226ae32edeef5f
-  React-featureflagsnativemodule: b8f00b01436294a30dc62fb5e50b70aa3910309c
-  React-graphics: d6207795fe822668daeb9c6e1f1470a8500d9eec
-  React-hermes: fcbdc45ecf38259fe3b12642bd0757c52270a107
-  React-idlecallbacksnativemodule: f390a518e1a862453f45f86a1bc248350634d858
-  React-ImageManager: acb99e093632b7fc2953dd45f2abaeeea2d9588e
-  React-jserrorhandler: 958ab9afbe7acdbfe8ca225f7503313409b1319a
-  React-jsi: 59ec3190dd364cca86a58869e7755477d2468948
-  React-jsiexecutor: b87d78a2e8dd7a6f56e9cdac038da45de98c944f
-  React-jsinspector: 9c33e0c4eeeb10a23b61c4501947b57977980e0e
-  React-jsinspectorcdp: d7b2c3feddd3669f0eaad2ac1e0f7afbc1d1cf18
-  React-jsinspectornetwork: 696d0cf07016e69c053deffba30003fa448904a3
-  React-jsinspectortracing: 05d49cd8795db15a279eab6f7604dfa9fe9622f1
-  React-jsitooling: 0f9894c3656c3c13d4fcfe6e1dc964fd340acf49
-  React-jsitracing: dc11027f9e4e829d32bf17626ec831581ea05223
-  React-logger: a3cb5b29c32b8e447b5a96919340e89334062b48
-  React-Mapbuffer: e4a65db5f4df53369f39558c0cf2f480f6d3d6c7
-  React-microtasksnativemodule: 86334c5c06315e0bccb7b6e6f2c905e92f98b615
-  react-native-safe-area-context: eda63a662750758c1fdd7e719c9f1026c8d161cb
-  react-native-usercentrics: 61e591b5b3d23360ec528b086e374cf53bbaeba0
-  react-native-webview: 83c663c5bdf1357d3e7c00986260cb888ea0e328
-  React-NativeModulesApple: 8c7eb6057b00c191a11ad5ced41826ec5a0e4d78
+  React-defaultsnativemodule: e741702f0e585c2f252cf1797ae7556312a5e43f
+  React-domnativemodule: 71832948d5efe4231231929f3ab8fb43c60e64be
+  React-Fabric: 40b52987bbf49a5eb3963d69eb79ee5fb474497d
+  React-FabricComponents: ac181f57440b220bc5c0c73a213c8f0beb4b402c
+  React-FabricImage: c32725d2935166d14fb6a0248ad5eec890a6665b
+  React-featureflags: f9cadeda57aa490c9c7a1df9af6866ef68bbddf6
+  React-featureflagsnativemodule: 2c4196feb481fe502e4549bf8cff78cb98514b59
+  React-graphics: b9a2c17b8baafe92ab5aad8ba940c30428cf9c99
+  React-hermes: 0a167bbb02c242664745e82154578c64e90a88e5
+  React-idlecallbacksnativemodule: 0950653cf076a6f98fe33403a70f9ab8506940bc
+  React-ImageManager: f2f1f5496db3912ebbc166701a381cea102123fd
+  React-jserrorhandler: ca36f91ee924e45aee9c14e5529ef7b94dcbfb8f
+  React-jsi: 9c27d27d3007b73c702ad3fd5a6166557c741020
+  React-jsiexecutor: 2b24f4ed4026344a27f717bf947a434cbbeeff7a
+  React-jsinspector: 4bba4426916dbad83fd71eef70350cdf6bac70d1
+  React-jsinspectorcdp: 2bde8377dc70d07c213c270135aaf3e9b660d6df
+  React-jsinspectornetwork: 25a94605232a7f5b9e74f54a1422a69baecf0517
+  React-jsinspectortracing: ccae54ad4669316451af1297cc6cbd731a098ca5
+  React-jsitooling: 754bebd7e20c271797bfa0df835b33dacfbf4821
+  React-jsitracing: 339c27481f2fa42c0a71afcec86cf46022fdbf20
+  React-logger: 1767babce2d28c3251039ce05556714a2c8c6ded
+  React-Mapbuffer: f84e59c14ff145295fbd029c5be16805aabe98d2
+  React-microtasksnativemodule: 584eb07c9b1f1e684fe63b7fae61ed865f8f228f
+  react-native-safe-area-context: 7e0ba374906d8f5009aaf96cd19d4866d8de342b
+  react-native-usercentrics: a1f2696c925473e81285d655d6f5f7c8294ee035
+  react-native-webview: 21fdd62caca650645e429b4a84941626612616ef
+  React-NativeModulesApple: dcfbe72c5a47baec0699a2935c080b7de0c8657b

Evidence

The lockfile clearly reflects the intended 2.28.1 bump for the local pod and UsercentricsUI
dependency, but the SPEC CHECKSUMS section includes many unrelated React Native pods’ checksums,
indicating a broad lockfile regeneration rather than a narrowly scoped update.

sample/ios/Podfile.lock[1927-1955]
sample/ios/Podfile.lock[2822-2888]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`sample/ios/Podfile.lock` was regenerated such that the `SPEC CHECKSUMS` section changed for many React Native pods (not only `react-native-usercentrics` / `Usercentrics(UI)`), creating unexplained lockfile churn.

## Issue Context
In the sample app, many pods are sourced from `../node_modules/...` (external sources). Their spec checksums should only change when the underlying podspec contents change (e.g., React Native / related package updates, patch-package changes, or intentional pod updates). For a release version bump PR, it’s important that the lockfile changes are intentional and reproducible.

## Fix Focus Areas
- sample/ios/Podfile.lock[2822-2888]
- sample/ios/Podfile.lock[1927-1955]

## Suggested fix
1. From a clean workspace, run the standard, deterministic install flow for the sample (e.g., `npm ci` in `sample/`, then `pod install` in `sample/ios/`).
2. Verify whether these checksum changes reproduce.
3. If they do not reproduce, revert unrelated `SPEC CHECKSUMS` changes and commit only the minimal lockfile updates needed for the 2.28.1 bump (typically `react-native-usercentrics` and `Usercentrics(UI)` entries).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---