v1.3.3 — One permission, and nothing else

One permission, and nothing else

Miroji no longer requests VIBRATE. It was never used — the app has no haptics dependency and never calls the Vibration API. It came from neither the app's own configuration nor any dependency, but from a default permission set that expo prebuild injects, inherited from Expo Go.

Verified directly on the built release APK, the app now requests:

android.permission.CAMERA

That is the complete list. A second entry, DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION, remains in the manifest but is not a capability the app asks for: AndroidX declares it at signature protection level to lock down its own internal broadcast receivers, it is namespaced to this app, it can only ever be granted to code signed with the same certificate, and it is never shown to users.

For an app whose entire purpose is showing you a mirror and keeping nothing, a single-permission surface is the clearest possible statement of that: it cannot reach the network, cannot write to storage, and cannot record audio, because it does not ask to.

Context

This completes the cleanup started in 1.3.2, which removed INTERNET, ACCESS_NETWORK_STATE and two unused dependencies. Together the two releases take the released permission set from seven entries down to one.

Full Changelog: v1.3.2...v1.3.3

v1.3.2 — Leaner permissions and a much smaller F-Droid build

Privacy & permissions

Miroji no longer requests INTERNET or ACCESS_NETWORK_STATE. The app performs no networking of any kind — no analytics, no crash reporting, no update checks — and these were only ever present because React Native declares them so debug builds can reach the Metro bundler.

The released permission surface is now CAMERA and VIBRATE only, verified directly on the built APK rather than the manifest.

Smaller builds

Two dependencies that were declared but never imported (@react-native-community/datetimepicker and @react-native-community/slider) have been removed.

Combined with restricting the F-Droid build to ARM architectures, the F-Droid-configured APK drops from 69 MB to 39.3 MB — 43% smaller — with zero Google Play Services or MLKit code in the binary. Google Play builds are unaffected and keep full architecture support, since Play generates per-device splits from the app bundle.

F-Droid packaging

This release is the first tagged build containing the full F-Droid pipeline: an automated source mirror, a patch that strips expo-camera's proprietary MLKit and Play Services dependencies while preserving its public API, and a build that compiles every module from source.

Maintenance

• Security advisories patched via dependency overrides: brace-expansion, fast-uri, shell-quote
• markdownlint-cli2 updated to 0.23.2
• Google Play badge removed from the README while Android is in closed testing

Full Changelog: v1.3.1...v1.3.2

v1.3.1

What's Changed

Patch release focused on permission-gate polish and repo hygiene.

Fixes

• fix(permission): the blocked-permission screen's "Open Settings" button sat flush against the guidance text — added a bottom margin so it has consistent breathing room in both permission states, matching the grant ("Continue") screen (#69).

Chore

• Ignore local EAS iOS build outputs (*.ipa) so they can't be accidentally committed (#70).
• Version bumped to 1.3.1.

Full Changelog: v1.3.0...v1.3.1

v1.3.0

What's Changed

Security

• Patched undici, ws, tar, form-data transitive advisories via pnpm.overrides (#58, #59) — clears the Dependabot alerts flagged since 1.2.6.

Fixes

• iOS App Store (Guideline 5.1.1): reworded the camera permission button from "Grant Permission" to "Continue" (#60).
• Web Storybook: fixed a build-time dependency-optimizer crash and a follow-up silent rendering hang, both caused by expo-modules-core's type-only declaration files being mishandled by Vite's Rolldown-based optimizer.
• Android splash screen: switched to an icon-only asset — Android 12+'s native windowSplashScreenAnimatedIcon API forces the icon into a square container, which clipped the taller icon+wordmark image used on iOS.

Features

• Open Settings button (#61): when camera permission is permanently blocked, PermissionGate now shows a button that opens the OS app settings directly, alongside the existing guidance text.
• Adaptive splash screen (#62): background now switches between white and black to match the device's light/dark mode, with the "Miroji" wordmark shown below the icon on iOS.

Docs

• Added COMMANDS.md, a day-to-day CLI quick reference (local builds, testing, Storybook, EAS, git workflow).
• Richer README badge section (build/deploy status, code quality, tech stack, project info, AI dev tooling).

Chore

• Version bumped to 1.3.0.

Full Changelog: v1.2.6...v1.3.0

v1.2.6

What's Changed

No app runtime changes — security patches and CI/CD hardening.

Security

• Patched shell-quote (🔴 critical — quote() newline escaping) → 1.8.4 and esbuild (high/low) → 0.28.1 via pnpm.overrides (#41). Clears all 3 Dependabot advisories.

CI / CD

• Firebase distribution: cancel-in-progress: false (#38) — a near-simultaneous second push can no longer cancel a version-bump's distribution run.
• Dependabot: ignore @testing-library/react-native major (#40) — RNTL 14 breaks the type-aware lint.
• expo/expo-github-action v8 → v9 (#32).

Fixes

• Apple Team ID corrected to MJ8B2UX599 (#39) — fixes a future App Store submit.

Chore

• Version bumped to 1.2.6.

Full Changelog: v1.2.5...v1.2.6

v1.2.5

What's Changed

Fixes

• Android adaptive icon no longer clipped (#34): the launcher was masking the mirror's top and handle because the foreground was the full composed icon (mirror spanning ~76% of the canvas, past the ~66% safe zone). Rebuilt as proper adaptive layers — the mirror isolated in the safe zone (foregroundImage) over a blue gradient backgroundImage. Verified on a physical Android device.

Chore

• Version bumped to 1.2.5.

Full Changelog: v1.2.4...v1.2.5

v1.2.4

What's Changed

A maintenance release — CI/dev-tooling only, no app runtime changes.

CI / CD

• EAS store submission is now manual-only (#29): eas submit runs only via workflow_dispatch with submit = true — never automatically on a push to main. This stops the auto-submit that failed on every prior release (the Android Play key is gitignored / absent in CI). The Google Play service-account key and Apple app-specific password are wired in via secrets for when you do ship. Pushes to main still run a production build to validate the release.

Dependencies (dev)

• lint-staged 17.0.6 → 17.0.7

• typescript-eslint 8.59.3 → 8.60.0

  (the clean, fully-converged Dependabot group — the endpoint of the Dependabot overhaul: it now proposes only standalone tooling, never Expo-SDK-managed packages.)

Chore

• Version bumped to 1.2.4.

Full Changelog: v1.2.3...v1.2.4

v1.2.3

What's Changed

A maintenance release — CI/config only, no app runtime changes.

Dependency management

• Completed the Dependabot ignore set (#25): added @react-native-community/* (scoped native modules), jest-expo (SDK-coupled test preset), and @types/jest to the ignores. These are all Expo-SDK-54-managed and were the last gap — Dependabot's regenerated group still proposed datetimepicker@9, slider@5.2, jest-expo@56, and @types/jest@30, none SDK-54-compatible. The ignore set now covers every Expo-managed package; Dependabot updates only genuinely-standalone tooling.

CI / CD

• Firebase distribution gated on version bump (#26): a check-version job means only version-bumping merges to develop create a Firebase release — ending the duplicate same-version releases.
• Bounded retry for the flaky iOS E2E (#26): absorbs the intermittent expo-camera iOS-simulator crash; a genuine failure still fails both attempts.

Chore

• Version bumped to 1.2.3.

Full Changelog: v1.2.2...v1.2.3

v1.2.2

What's Changed

A maintenance release — CI/config only, no app runtime changes.

Dependency management

• Dependabot compatibility ignores (#21): block the major bumps that are incompatible with Expo SDK 54, so they stop being proposed:
  • eslint major — 9 → 10 breaks eslint-plugin-react@7.x (context.getFilename was removed in ESLint 10).
  • typescript major — 5.9 → 6.0 conflicts with the SDK's pinned ~5.9 and bundled type definitions.
  • 9.x / 5.x updates still flow; these ceilings lift on a deliberate SDK/plugin upgrade.

CI / tooling

• Skip E2E + auto-assign on Dependabot PRs (#20): those workflows require secrets that Dependabot PRs can't access, so they no longer surface misleading red checks — they skip cleanly (a skipped required check counts as passing).
• actions/setup-node v4 → v6 (#18).

Chore

• Version bumped to 1.2.2.

Full Changelog: v1.2.1...v1.2.2

v1.2.1

What's Changed

A maintenance release — CI/config only, no app runtime changes.

Dependency management

• Dependabot reconfigured for Git Flow + Expo SDK 54 (#14): opens PRs against develop instead of main; ignores Expo-SDK-managed packages (expo, expo-*, react, react-native*, @types/react, react-test-renderer) so it no longer proposes SDK-54-incompatible native bumps; groups npm dev-tooling and GitHub Actions updates into single PRs.
• Closed 4 Dependabot PRs that bumped SDK-54-pinned packages (expo-dev-client@56, gesture-handler@3, safe-area-context@5.8, react).

CI / tooling

• GitHub Actions bumps (#15): actions/checkout@v6, pnpm/action-setup@v6, actions/setup-java@v5, actions/github-script@v9, actions/upload-artifact@v7.
• lint-staged 17.0.5 → 17.0.6.

Chore

• Version bumped to 1.2.1 (#16).

Full Changelog: v1.2.0...v1.2.1