chore: bump react-native-permissions to 5.6.0

[adnxy]

Pre-upgrade dependency bump for the RN 0.85 migration (Wave 4 — verified required). 3.7.2 is out of support and incompatible with the RN 0.85 toolchain; 5.6.0 is the validated target. Landing it now on 0.83 isolates any regression and gives it soak time on main.

Description

Bumps react-native-permissions from ^3.7.2 to ^5.6.0 as part of the incremental pre-upgrade dependency work for React Native 0.85.

Changes required by the v4/v5 API:

• PERMISSIONS.IOS.BLUETOOTH_PERIPHERAL renamed to PERMISSIONS.IOS.BLUETOOTH — updated useBluetoothPermissions.ts, its test mock, and the global app/__mocks__/react-native-permissions.ts (Android constants unchanged)
• iOS Podfile migrated from the per-permission pod (Permission-BluetoothPeripheral) to the v4+ setup_permissions(['Bluetooth']) flow — permission handlers are now compiled into RNPermissions directly
• NSBluetoothAlwaysUsageDescription was already present in both Info.plists (required by the Bluetooth handler) — no plist change needed

Our only usage of this library is Bluetooth permissions for Ledger hardware wallet flows (useBluetoothPermissions, LedgerBluetoothAdapter).

Verified locally: yarn lint:tsc green, both consumer test suites pass (103 tests), pod install resolves cleanly (RNPermissions 5.6.0, Permission-BluetoothPeripheral pod removed).

Changelog

CHANGELOG entry: null

Related issues

Fixes:

Manual testing steps

Feature: Bluetooth permissions for Ledger

  Scenario: user connects a Ledger device
    Given the app is freshly installed
    When user starts the Ledger pairing flow
    Then the OS Bluetooth permission prompt appears
    And granting it allows device scanning to proceed on both iOS and Android

Screenshots/Recordings

N/A — dependency version bump, no visual changes expected.

Before

N/A

After

N/A

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Medium Risk
Touches OS permission prompts for Ledger Bluetooth on iOS and changes native iOS pod wiring; scope is narrow but device manual testing is important.

Overview
Upgrades react-native-permissions from ^3.7.2 to ^5.6.0 ahead of the RN 0.85 migration, with lockfile and iOS pod updates (RNPermissions 5.6.0).

For v4/v5 breaking changes, iOS Bluetooth permission requests now use PERMISSIONS.IOS.BLUETOOTH instead of BLUETOOTH_PERIPHERAL in useBluetoothPermissions and in Jest mocks. Android permission usage is unchanged.

On iOS, the Podfile drops the Permission-BluetoothPeripheral subpod and adopts setup_permissions(['Bluetooth']) so the Bluetooth handler is built into RNPermissions.

^{Reviewed by Cursor Bugbot for commit f27627c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[metamask-ci]

PR template — items to address before "Ready for review"

Warnings — informational, address before merging:

• Related issues section is empty. Add Fixes: #123 / Closes: <URL> / Refs: <Jira key>, or write a short rationale after the colon.
• Pre-merge author checklist has only 5 of the required 8 items. Every checklist row must be present and consciously checked — do not delete rows.

See docs/readme/ready-for-review.md for the full Definition of Ready for Review.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​react-native-permissions@​3.10.1 ⏵ 5.6.0	+1

View full report

[github-actions]

🧪 Flaky unit test detection

Run history flaky detection

View recent run history

Historical failure rate is a hint, not proof — review each suggestion in context. See the flaky-test-detection skill for the full pattern reference and manual audit workflow.

Failures / runs sampled per window:

File	7d	15d	30d
app/components/hooks/useBluetoothPermissions.test.ts	0/159	0/191	0/334

AI-detected flaky patterns

app/components/hooks/useBluetoothPermissions.test.ts

• J10 — jest.spyOn without restoreAllMocks() (medium)
  • jest.spyOn(AppState, 'addEventListener') replaces the real implementation with a spy. jest.resetAllMocks() resets call counts and return values but does NOT restore the original implementation — the spy persists for the entire Jest worker lifetime. Any test that runs after this suite (or a future test added to this file) that relies on the real AppState.addEventListener will silently receive the spy instead of the original. Adding jest.restoreAllMocks() in an afterEach ensures the original is restored after every test.
  • Suggested fix in app/components/hooks/useBluetoothPermissions.test.ts:47:

    -  beforeEach(() => {
    -    jest.resetAllMocks();
    -    jest.spyOn(AppState, 'addEventListener').mockReturnValue({
    -      remove: jest.fn(),
    -    } as unknown as ReturnType<typeof AppState.addEventListener>);
    -  });
    +  beforeEach(() => {
    +    jest.resetAllMocks();
    +    jest.spyOn(AppState, 'addEventListener').mockReturnValue({
    +      remove: jest.fn(),
    +    } as unknown as ReturnType<typeof AppState.addEventListener>);
    +  });
    +
    +  afterEach(() => {
    +    jest.restoreAllMocks();
    +  });

• J1 — Synchronous act() wrapping an async state-updating callback (critical)
  • The AppState change handler triggered here calls requestMultiple(), which is mocked with .mockResolvedValue(...) — a Promise. The Promise resolution and any resulting hook state updates are microtasks that execute after the synchronous act() completes. React will emit 'not wrapped in act()' warnings and the assertion on call count may race against those pending updates, producing intermittent failures under load. The test function must be made async and act() must be awaited as async so all microtasks are flushed before the assertion runs.
  • Suggested fix in app/components/hooks/useBluetoothPermissions.test.ts:153:

    -  it('checks permissions when app state changes to active', () => {
    -    (Device.isAndroid as jest.Mock).mockReturnValue(true);
    -    (getSystemVersion as jest.Mock).mockReturnValue('12');
    -    (requestMultiple as jest.Mock).mockResolvedValue({
    -      [PERMISSIONS.ANDROID.BLUETOOTH_CONNECT]: RESULTS.GRANTED,
    -      [PERMISSIONS.ANDROID.BLUETOOTH_SCAN]: RESULTS.GRANTED,
    -    });
    -
    -    AppState.currentState = 'background';
    -    renderHook(() => useBluetoothPermissions());
    -    //checkPermission run once when hook is mounted
    -    expect(requestMultiple).toHaveBeenCalledTimes(1);
    -
    -    act(() => {
    -      (AppState.addEventListener as jest.Mock).mock.calls[0][1]('active');
    -    });
    -
    -    //checkPermission run again when app state changes to active
    -    expect(requestMultiple).toHaveBeenCalledTimes(2);
    -  });
    +  it('checks permissions when app state changes to active', async () => {
    +    (Device.isAndroid as jest.Mock).mockReturnValue(true);
    +    (getSystemVersion as jest.Mock).mockReturnValue('12');
    +    (requestMultiple as jest.Mock).mockResolvedValue({
    +      [PERMISSIONS.ANDROID.BLUETOOTH_CONNECT]: RESULTS.GRANTED,
    +      [PERMISSIONS.ANDROID.BLUETOOTH_SCAN]: RESULTS.GRANTED,
    +    });
    +
    +    AppState.currentState = 'background';
    +    renderHook(() => useBluetoothPermissions());
    +    //checkPermission run once when hook is mounted
    +    expect(requestMultiple).toHaveBeenCalledTimes(1);
    +
    +    await act(async () => {
    +      (AppState.addEventListener as jest.Mock).mock.calls[0][1]('active');
    +    });
    +
    +    //checkPermission run again when app state changes to active
    +    expect(requestMultiple).toHaveBeenCalledTimes(2);
    +  });

• J1 — Synchronous act() wrapping an async state-updating callback (critical)
  • Same J1 pattern as the previous test: the AppState change handler is async (calls requestMultiple which returns a Promise via mockResolvedValue), but act() is synchronous. Any state updates from the resolved promise escape the act() boundary, causing potential 'not wrapped in act()' warnings and order-dependent assertion results. The test function must be made async and act() must be awaited as async.
  • Suggested fix in app/components/hooks/useBluetoothPermissions.test.ts:173:

    -  it('does not check permissions when app state changes to background', () => {
    -    (Device.isAndroid as jest.Mock).mockReturnValue(true);
    -    (getSystemVersion as jest.Mock).mockReturnValue('12');
    -    (requestMultiple as jest.Mock).mockResolvedValue({
    -      [PERMISSIONS.ANDROID.BLUETOOTH_CONNECT]: RESULTS.GRANTED,
    -      [PERMISSIONS.ANDROID.BLUETOOTH_SCAN]: RESULTS.GRANTED,
    -    });
    -
    -    AppState.currentState = 'background';
    -    renderHook(() => useBluetoothPermissions());
    -    //checkPermission run once when hook is mounted
    -    expect(requestMultiple).toHaveBeenCalledTimes(1);
    -
    -    act(() => {
    -      (AppState.addEventListener as jest.Mock).mock.calls[0][1]('inactive');
    -    });
    -
    -    //checkPermission does not run when app state changes to inactive
    -    expect(requestMultiple).toHaveBeenCalledTimes(1);
    -  });
    +  it('does not check permissions when app state changes to background', async () => {
    +    (Device.isAndroid as jest.Mock).mockReturnValue(true);
    +    (getSystemVersion as jest.Mock).mockReturnValue('12');
    +    (requestMultiple as jest.Mock).mockResolvedValue({
    +      [PERMISSIONS.ANDROID.BLUETOOTH_CONNECT]: RESULTS.GRANTED,
    +      [PERMISSIONS.ANDROID.BLUETOOTH_SCAN]: RESULTS.GRANTED,
    +    });
    +
    +    AppState.currentState = 'background';
    +    renderHook(() => useBluetoothPermissions());
    +    //checkPermission run once when hook is mounted
    +    expect(requestMultiple).toHaveBeenCalledTimes(1);
    +
    +    await act(async () => {
    +      (AppState.addEventListener as jest.Mock).mock.calls[0][1]('inactive');
    +    });
    +
    +    //checkPermission does not run when app state changes to inactive
    +    expect(requestMultiple).toHaveBeenCalledTimes(1);
    +  });

This check is informational only and does not block merging.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: SmokeAccounts, SmokeConfirmations, SmokeNetworkAbstractions, SmokeNetworkExpansion, SmokeSwap, SmokeStake, SmokeWalletPlatform, SmokeMoney, SmokePerps, SmokeMultiChainAPI, SmokePredictions, SmokeSeedlessOnboarding, SmokeBrowser, SmokeSnaps
• Selected Performance tags: None (no tests recommended)
• Risk Level: high
• AI Confidence: 100%

click to see 🤖 AI reasoning details

E2E Test Selection:
Hard rule (global-infrastructure-change): Global infrastructure changed: app/components/hooks/useBluetoothPermissions.test.ts, app/components/hooks/useBluetoothPermissions.ts. Running all tests.

Performance Test Selection:
The changes are limited to iOS Bluetooth permission API updates and a dependency upgrade for react-native-permissions. No performance-sensitive code paths (app launch, login, onboarding, asset loading, swaps, etc.) are affected. No performance test tags are warranted.

View GitHub Actions results