[arosasg]

Do not merge before sdk-ios 4.10.0 and sdk-android 4.10.0 are published (2026-11-01)

The pins below resolve native 4.10.0 binaries that do not exist yet. Native example builds (example, example-expo) fail until then. After the native releases are out, merge, tag v4.10.0 (the release workflow reads release-notes/4.10.0.md) and publish.

Summary

• package.json version and diditNativeSdkVersions.ios / .android set to 4.10.0. The temporary diditNativeSdkVersions.source development pin is removed. The native-sdk-source.js mechanism stays and is a no-op without a source key (covered by a test).
• iOS Location uses the native Location variants. When Location is enabled, SdkReactNative.podspec, the Expo config plugin and both example Podfiles declare exactly one subspec: all -> DiditSDK/All-Location, core and autodetection -> DiditSDK/Core-Location, nfc -> DiditSDK/NFC-Location. SwiftPM uses DiditSDKLocation, DiditSDKCoreLocation, DiditSDKNFCLocation, and no longer raises "Location requires CocoaPods linkage". The Core-Location, NFC-Location and All-Location folders are added to FRAMEWORK_SEARCH_PATHS.
• Android wrapper default Kotlin is now 2.1.20 (native 4.10.0 needs Kotlin 2.1.10+, AGP 8.6.0+, Gradle 8.7+, JDK 17). The wrapper's AGP 8.7.2 and both examples (Gradle 9.0.0, React Native 0.83 toolchain with AGP 8.12 and Kotlin 2.1.20) already meet the floor. README requirements state it.
• README: Location on iOS describes the Location variants, the development preview paragraph is removed, Bank section updated, variants table no longer implies automatic capture depends on the variant (stale iOS size table removed).
• release-notes/4.10.0.md added.
• packages/auth-react-native is private, version 0.0.0 and declares no native DiditAuth dependency, so there are no pins to bump and it does not ship in this release. Its version is not touched.

Verification

yarn test: 14 of 15 suites pass. The one failure, packages/auth-react-native/src/__tests__/packaging.test.ts (autolinking), fails identically on an untouched main checkout because the local node_modules lacks the workspace links; it is unrelated to this change.

Test Suites: 1 failed, 14 passed, 15 total
Tests:       1 failed, 126 passed, 127 total

yarn typecheck and yarn lint exit 0.

🤖 Generated with Claude Code

[arosasg]

Codex review (codex CLI, account codex-5, model gpt-5.6-sol)

---

💡 Code review

Reviewed commit: f486fd7

Map the deprecated Android autodetection variant to core

package.json:L6 - view

When an app selects androidVariant: "autodetection", this new 4.10.0 pin still makes android/build.gradle request me.didit:didit-sdk-autodetection:4.10.0, but this release explicitly no longer publishes that artifact, so Gradle dependency resolution fails. Preserve the deprecated option by mapping it to didit-sdk-core, which the release notes identify as its replacement.

Verdict: REQUEST CHANGES

[arosasg]

Round 1 finding (map Android autodetection to core): fixed in f3116a9, on both platforms. One correction to its premise: native 4.10.0 does still publish didit-sdk-autodetection (deprecated and empty, it only depends on didit-sdk-core), so resolution would not fail. Depending on core directly is still the better choice, since the native release notes tell apps to drop the deprecated artifact; iOS autodetection now resolves to DiditSDK/Core / DiditSDKCore the same way.

[arosasg]

Codex review (codex CLI, account codex-5, model gpt-5.6-sol)

---

💡 Code review

Reviewed commit: f3116a9

No blocking findings in commit f3116a9.

Verdict: APPROVE