Release: staging v2.9.16 — recovery, navigation, security, cleanup

[github-actions]

What's New — Apr 6–9, 2026

New

• Recovery phrase is now shown during onboarding immediately after registration, so users can save it before continuing
• Firebase Analytics added for usage insights
• OFAC compliance now supports on-chain proof-based root updates with rolling window verification

Improved

• Account recovery now works after restoring a phone from iCloud or Google backup — the app detects missing credentials and guides you through recovery on first launch
• Tunnel verification flow keeps you inside the flow when navigating back — no more unexpected jumps to the home screen
• WebView security hardened across all platforms: origin-validated bridge messages, localhost asset serving, and SSL enforcement
• Support form and self.xyz links now open inside the app instead of launching an external browser
• Navigation headers show consistent back buttons and close labels across all screens

Fixed

• App no longer dead-ends at a blank home screen after phone restore
• Back buttons in tunnel flow no longer escape to unrelated screens
• Nav bar title font no longer overridden by undefined style properties
• Mock passport flow no longer incorrectly routes to the recovery-required screen
• Android WebView content no longer renders under the status bar or notch
• Referral attribution preserved correctly when registration fails (no longer cleared prematurely)

Removed

• Points, Self Apps, and Gratification screens removed to unblock the 3.0 release

---

Internal changes

• Renamed Didit-specific code to generic KYC naming for future provider flexibility (Rename KYC references to be platform agnostic #1947, Rename KYC_TEE_URL and fix nav header regressions #1948)
• Upgraded React Navigation, Tamagui, WalletConnect, Lottie, XState, and 20+ other dependencies (Upgrade Wave 2 mobile app dependencies (React Navigation, Tamagui, WalletConnect, Lottie, XState) #1941, Bump dependencies across app and root workspaces #1939, Add Firebase Analytics and upgrade app dependencies #1944)
• Fixed reproducible Ruby gem installs and upgraded build tooling (Fix reproducible Ruby gem installs and upgrade dependencies #1937)
• Hardened WebView bridge and asset serving across native shells (Harden WebView bridge and asset serving across native shells #1924)
• WebView layout and Android inset fixes, iOS dev server support (Fix WebView layout, Android insets, and iOS dev server support #1935)
• SDK distribution spec updated with KMP publishing plan (Update SDK distribution spec to add kmp publishing plan #1929)

Linear Issues

• SELF-2540 — No account recovery flow after phone restore
• SELF-2311 — Remove Points and Self Apps screens
• SELF-2585 — Remove Sumsub references & abstract to generic KYC naming
• SELF-2504 — Add recovery phrase screen to onboarding
• SELF-2487 — Tunnel flow back-navigation breaks out of flow

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
self-webview-app	Ignored	Preview	Apr 9, 2026 9:03pm