Repository navigation
[Due for payment 2026-10-01] chore(deps): Upgrade NitroModules from 0.36.3 to 0.37.1 #101472
Description
Summary
Update react-native-nitro-modules from 0.36.3 to the latest release (0.37.1), bump the packages that peer-depend on it, and refresh the generated and version-pinned code that follows from the bump.
Why update
- NewDot is a minor behind the Nitro native runtime.
0.37.1is the current published release; main is still on0.36.3. - NitroFetch is blocked by the old pin.
[email protected]declaresreact-native-nitro-modules: ^0.36.1, so it cannot resolve against0.37.x.1.6.2widens that range to>=0.36.1, which unblocks the runtime bump. - Nitrogen must track NitroModules exactly. The
nitrogencodegen dependency ships in lockstep with the runtime, and[email protected]depends onreact-native-nitro-modules: ^0.37.1. Leaving the codegen behind produces bindings that don't match the runtime.
Scope
- Bump in
package.json:react-native-nitro-modules0.36.3→0.37.1nitrogen(devDependency)0.36.3→0.37.1react-native-nitro-fetch1.5.4→1.6.2(the version whose peer range accepts0.37.1)
- Regenerate the local Nitro bindings for
modules/ExpensifyNitroUtils. Nitrogen0.37.1adds a@FastNativeannotation to the generated AndroidinitHybrid()declarations for the contacts and app-start-time modules. - Rename Expensify's Android Cronet certificate-pinning patch to the new NitroFetch version so
patch-packagestill applies it, and update the two places that reference the versioned filename:patches/react-native-nitro-fetch/details.mdscripts/generateCertificatePins.sh- The patch contents themselves should not need to change — only the versioned filename.
- Update the NitroModules and NitroFetch entries plus their checksums in
ios/Podfile.lock. - Pin the same native versions in HybridApp's own lockfile in
Mobile-Expensifyvia a companion PR, so standalone NewDot and HybridApp build against one runtime.
Out of scope
react-native-nitro-sqlite is tracked separately in chore(deps): Update NitroSQLite from 9.6.0 to 9.8.0 so the two dependency updates can be reviewed independently. The NitroModules bump should land after that one, keeping the SQLite changes out of its diff.
Testing
The change is native-runtime and lockfile only, so it needs real device builds on iOS and Android — chat send plus relaunch persistence, the contacts-backed participant search with permission granted and denied, and an offline/reconnect pass confirming no certificate-pinning errors.
Follow-up
[email protected] is already published and its peer range (react-native-nitro-modules: >=0.36.1) also accepts 0.37.1. Decide whether to take 1.7.0 in this update or move to it separately afterwards.
Activity
melvin-bot commentedon Sep 21, 2026
@chrispader
The solution for this issue has been 🚀 deployed to production 🚀 in version 9.4.90-2 and is now subject to a 7-day regression period 📆. Here is the list of pull requests that resolve this issue:
melvin-bot commentedon Sep 24, 2026
@chrispader Whoops! This issue is 2 days overdue. Let's get this updated quick!
melvin-bot commentedon Sep 28, 2026
@chrispader 6 days overdue. This is scarier than being forced to listen to Vogon poetry!
chrispader commentedon Sep 29, 2026
This is done! #101471 has been merged.
chrispader commentedon Sep 29, 2026
@MelvinBot assign the C+ here and whoever is handling payments
MelvinBot commentedon Sep 29, 2026
I assigned two people to this issue:
marufsharifiis the C+ who reviewed chore(deps): Upgrade NitroModules to 0.37.1.mallenexpensifyhandles payments on most of your recent issues.view run
marufsharifi commentedon Sep 30, 2026
Contributor+ Checklist:
[Contributor] The offending PR and associated issue have been commented on, pointing out the bug it caused and why, so the author and reviewers can learn from the mistake.
Link to the comment on the PR:
Link to the comment on the Issue:
[Contributor] If the regression was CRITICAL (e.g. interrupts a core flow) A discussion in #expensify-open-source has been started about whether any other steps should be taken (e.g. updating the PR review checklist) in order to catch this type of bug sooner.
Link to discussion:
[Contributor] If it was decided to create a regression test for the bug, please propose the regression test steps using the template below to ensure the same bug will not reach production again.
Regression Test Proposal
Precondition:
Test:
On iOS, sign in, open a chat, send a message, force-close and relaunch the app, and verify that both the message and sign-in state persist.
Repeat the chat persistence and relaunch flow on Android. Then, with contacts permission granted, open participant search for a money request and verify that device contacts are displayed and selectable.
Deny contacts permission, reopen participant search, and verify that the app displays the expected permission flow without crashing.
Do we agree 👍 or 👎
[-]chore(deps): Upgrade NitroModules from 0.36.3 to 0.37.1[/-][+][Due for payment 2026-10-01] chore(deps): Upgrade NitroModules from 0.36.3 to 0.37.1[/+]melvin-bot commentedon Oct 1, 2026
Current assignee @mallenexpensify is eligible for the Awaiting Payment assigner, not assigning anyone new.
melvin-bot commentedon Oct 1, 2026
Payment Summary
Resolving PRs:
chore(deps): Upgrade NitroModules to 0.37.1 #101471
Contributor: @chrispader does not require payment (Contractor)
Assignee: @marufsharifi requires payment (Needs manual offer from BZ)
BugZero Checklist (@mallenexpensify)
mallenexpensify commentedon Oct 3, 2026
Payment Summary
Contributor+: @marufsharifi paid $250 via NewDot
@marufsharifi can you please accept the job below? Please reply here and tag me once you have.
https://www.upwork.com/jobs/~022106395352756573957
marufsharifi commentedon Oct 5, 2026
@mallenexpensify, I've accepted the offer. thanks.
mallenexpensify commentedon Oct 5, 2026
@marufsharifi paid, summary updated above. Thx.