feat: release app modules 3.0.92 for React Native 0.86

[huhuanming]

Summary

• sync the React Native 0.86 native module changes previously carried by app-monorepo patches
• migrate @onekeyfe/react-native-text-input into app-modules, including Android and iOS support
• update and publish all 36 @onekeyfe/* app modules as version 3.0.92
• defer Android text-input paste dispatcher lookup and safely handle a missing dispatcher
• harden background-thread and split-bundle lifecycle behavior for reload and cold-start scenarios

Validation

• downstream app-monorepo Android :app:assembleGoogleDebug build passed
• APK contains libQuickCrypto.so, libcrypto.so, and libssl.so
• downstream iOS simulator build passed
• all 36 packages are available as 3.0.92 under the npm next dist-tag

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​react-native/​metro-config@​0.83.0 ⏵ 0.86.2
	npm/​@​react-native/​typescript-config@​0.83.0 ⏵ 0.86.2
	npm/​@​react-native/​new-app-screen@​0.83.0 ⏵ 0.86.2
	npm/​@​react-native-community/​cli@​20.0.0 ⏵ 20.1.0			+1
	npm/​@​react-native/​jest-preset@​0.86.2
	npm/​react-test-renderer@​19.2.0 ⏵ 19.2.3
	npm/​@​react-native/​babel-preset@​0.83.0 ⏵ 0.86.2	+1
	npm/​react@​19.2.0 ⏵ 19.2.3
	npm/​@​react-native/​eslint-config@​0.83.0 ⏵ 0.86.2	+1		+9
	npm/​@​react-native-community/​cli-platform-android@​20.0.0 ⏵ 20.1.0
	npm/​@​react-native-community/​cli-platform-ios@​20.0.0 ⏵ 20.1.0
	npm/​react-native@​0.83.0 ⏵ 0.86.2	+12		+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @react-native/debugger-frontend is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: example/react-native/package.json → npm/react-native@0.86.2 → npm/@react-native/debugger-frontend@0.86.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.86.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @react-native/debugger-frontend is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: example/react-native/package.json → npm/react-native@0.86.2 → npm/@react-native/debugger-frontend@0.86.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.86.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[originalix]

Automated code review found blocking issues

@huhuanming

Reviewed commit 94e9e88a10e5. This report always reflects the latest reviewed changes.

Review summary

Before: the repository targeted React Native 0.83 and had no package-owned text-input paste event implementation; background-thread and split-bundle runtime setup used the prior lifecycle paths.

After: the workspace is synchronized to React Native 0.86.2/React 19.2.3, adds a cross-platform text-input package that emits text and image paste events, and adds background-runtime generation/HMR and ordered split-bundle loading safeguards. Existing package APIs and OTA bundle paths remain otherwise unchanged.

What needs attention: Verify Android direct-event wiring for onPaste, clean up temporary image-paste files on iOS, and add executable native behavior tests before relying on the new runtime paths.

Issues to address

• P1 · Android onPaste prop is typed as a boolean ReactProp
  • Impact: Input.js passes the consumer callback as onPaste, while TextInputViewManager declares the same name as a Boolean @ReactProp and also registers it as a direct event. Depending on the renderer, the callback can be coerced as a Boolean during view updates or the setter can be skipped, leaving mPasteWatcher unset and making Android paste events fail.
  • Suggested action: Keep onPaste exclusively as the direct event and enable paste watching independently, such as attaching the watcher in createViewInstance or introducing a separate boolean enablement prop.
• P2 · iOS image paste files are never cleaned up
  • Impact: Every successful image paste writes clipboard bytes to NSTemporaryDirectory and emits the file URL, but no deletion or expiry is scheduled. Repeated pastes retain copied images indefinitely, increasing storage usage and leaving potentially sensitive clipboard data on disk.
  • Suggested action: Define an ownership/expiry contract for emitted image URLs and remove each temporary file after consumption or via a bounded cleanup policy.
• P2 · New native text-input behavior has no executable tests
  • Impact: The package adds platform-specific paste interception, controlled-text synchronization, focus commands, and image handling, but its only test is it.todo("write a test"). Regressions in either renderer or platform can therefore merge without automated detection.
  • Suggested action: Replace the placeholder with tests covering text/image paste payloads, controlled value/selection updates, focus/blur/clear commands, and both Android and iOS event wiring.

Validation gaps

• No dependency installation or package typecheck could run in the provided workspace because the Yarn node_modules state is absent.
• No Android/iOS build or device-level paste test is present in the diff.
• The new test file contains no executable assertions.