Release 2.4.1

v2.4.1 — npm metadata refresh & contributor docs

A docs- and metadata-only patch. No code changes — same library as 2.4.0.

This release primarily makes the v2.4.0 positioning work visible on the npm registry, where most prospective users discover the package.

What's new

📦 npm-visible metadata

• New description leads with "v3 score-based (invisible)" so users discovering the package via npm search immediately know it's the score-based variant (not v2 challenges or hCaptcha).
• Expanded keywords: added recaptcha-v3, score-based, invisible, abort-signal, enterprise, typescript, bot-protection, ios, android, and others — improves discoverability for the actual use cases.
• Declared engines.node >=18 to match the CI test matrix. Older Node runtimes will see a warning during install but installs will still complete.

📚 Documentation

• README: full rewrite with clearer positioning, a "Picking the right package" table for v2/v3/Enterprise/hCaptcha, an honest "About the WebView approach" section, per-error reference table, and an FAQ comparing this package to alternatives.
• CONTRIBUTING.md: rewrite — removed stale references to a monorepo, an example/ directory, and pre-commit hooks that didn't exist in the project.
• SECURITY.md (new): private vulnerability reporting flow via GitHub security advisories; supported-versions table; explicit scope.

🧱 Repo hygiene (for contributors)

• Issue templates (bug.yml, feature.yml) with structured fields and pre-flight checks that redirect "wrong package" reports before they're filed.
• Pull request template with a Conventional Commits checklist.
• Issue config.yml that disables blank issues and points security reports, v2 challenge seekers, and hCaptcha seekers to the right destinations.

🔌 Migrating from 2.4.0

- "@valture/react-native-recaptcha-v3": "^2.4.0"
+ "@valture/react-native-recaptcha-v3": "^2.4.1"

No source changes required. Identical runtime behavior.

If you're upgrading from a version older than 2.4.0, the meaningful changes are in the v2.4.0 release notes.

Full Changelog: v2.4.0...v2.4.1

Release 2.4.0

v2.4.0 — Lifecycle hardening, security defaults, enterprise & abort signals

A comprehensive audit-and-improve pass. All changes are non-breaking — existing code continues to work; new features are additive; behavior changes have escape-hatch props.

See PR #6 for the full review.

✨ New features

• AbortSignal support — cancel an in-flight getToken():

  const controller = new AbortController();
  recaptchaRef.current?.getToken('checkout', { signal: controller.signal });
  controller.abort(); // promise rejects with 'Token request was aborted.'

• reCAPTCHA Enterprise — opt in with the new useEnterprise prop. Switches to enterprise.js and grecaptcha.enterprise.execute.
• onVerify now receives the action — onVerify?: (token, action) => void. Useful when one component handles multiple actions. Existing handlers that ignore the extra arg keep working.

🐛 Bug fixes

• onLoadEnd fires exactly once per load cycle (was 2–3×).
• Concurrent reset() calls no longer leak the first promise — all queued resolvers now fire on the next load.
• reset() rejects in-flight and queued token requests immediately with a clear RESET error (used to hang until the request's own timeout).
• Superseded requests now reject with a SUPERSEDED error instead of the misleading TOKEN_REQUEST_TIMEOUT.
• Force-READY timer no longer reads closure-stale isReady / hasError — uses refs so the latest values win.
• handleLoadStart no longer wipes pendingRequests — previously dropped getToken() calls queued between mount and the WebView's first onLoadStart.
• Unmount cleanup — all timers (init, force-READY, in-flight, queued) and abort listeners are now cleared on unmount, fixing a real memory leak when the component unmounts mid-flight.

🛡️ Security

These change defaults but each has an opt-out prop, so existing setups can pin the old behavior if needed.

• mixedContentMode is now configurable, defaulting to 'never' (was hard-coded 'always'). Pass mixedContentMode="always" to restore.
• originWhitelist is now configurable, defaulting to ['https://www.google.com', 'https://www.gstatic.com', baseUrl] (was ['*']). Pass originWhitelist={['*']} to restore.
• siteKey is regex-validated at mount (/^[A-Za-z0-9_-]{20,80}$/). Invalid keys surface via onError instead of being interpolated into the WebView's HTML/URL.

🧱 Internal

• HTML template memoized (was rebuilt every render).
• Magic numbers extracted to named constants.
• NodeJS.Timeout → portable ReturnType<typeof setTimeout>.

🧪 Tests & CI (new)

• 32 unit tests covering all bug fixes and the public API, using jest + @testing-library/react-native with a controllable WebView mock.
• GitHub Actions CI runs lint · typecheck · test · build on every PR across Node 20 and 22.

🔌 Migrating

- "@valture/react-native-recaptcha-v3": "^2.3.0"
+ "@valture/react-native-recaptcha-v3": "^2.4.0"

No source changes required.

Full Changelog: v2.3.0...v2.4.0

Release 2.3.0

What's Changed

🐛 Bug Fixes

• Fix double WebView reload when siteKey or baseUrl props change. reset() already reloads the WebView, so the redundant follow-up reload has been removed.
• Fix orphaned token promise on concurrent getToken() calls. Previously, if you called getToken() twice before the first resolved, the first promise would hang until its own 15s timeout fired. It's now rejected immediately when superseded.

🧹 Internal

• Migrated to ESLint 9 flat config so yarn lint works (the legacy config referenced a preset that wasn't installed).
• Removed deprecated @types/react-native devDep (RN ships its own types since 0.71).
• Removed unused eslint-plugin-prettier devDep.
• Bumped react-native-webview devDep to 13.16.1 (peer-dep range unchanged).
• Refactored minified inline onload/onerror script handlers into named functions for readability.

📦 Package

• No public API changes
• No breaking changes
• Package size unchanged: 10.6 kB tarball / 37.6 kB unpacked

Full Changelog: v2.2.0...v2.3.0

Release 2.2.0

2.2.0 (2025-11-04)

Features

• enhance ReCaptcha component with improved error handling and new features (cdae6b9)

Release 2.1.0

2.1.0 (2025-09-26)

Features

• improve ReCaptcha component with enhanced onload handling and fallback readiness checks (33341a3)

Release 2.0.1

2.0.1 (2025-09-25)

Bug Fixes

• simplify package exports by removing redundant module format entries (28be3c5)
• update package exports to support multiple module formats (2f5f4dc)

Release 2.0.0

2.0.0 (2025-09-25)

Features

• fix types and drastically reduce package size; keep readable templates (91aad3b)

BREAKING CHANGES

• ESM build removed; consumers should use CommonJS entry ().

Release 1.1.1

1.1.1 (2025-09-25)

Release 1.1.0

1.1.0 (2025-05-07)

Features

• enhance ReCaptcha component with readiness check and improved error handling (cda1262)

Release 1.0.10

1.0.10 (2025-05-07)

Bug Fixes

• update TypeScript configuration and improve error handling in ReCaptcha component (6ce3660)