feat(react-native): incoming message origin validation

[tiagocandido]

What changes are you making?

Expose allowedMessageOrigins through the React Native configuration and round-trip it across both native bridges. Rejections are logged as warnings by the native SDKs (#646, #647); there is no JavaScript callback.

Bumps the native SDK pins to 4.0.0-alpha.5 — the first release with warn-level rejection logging and without onMessageRejected — and regenerates both Podfile.locks against the published pods.

Replaces #477.

How to test

From platforms/react-native:

pnpm test modules/@shopify/checkout-kit-react-native/tests/index.test.ts --runInBand
pnpm module typecheck
pnpm module api:dump

[tiagocandido]

• feat(react-native): incoming message origin validation #648 👈 (View in Graphite)
• refactor(android): log message rejections as warnings #647
• refactor(swift): log message rejections as warnings #646
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

React Native — Coverage Report

Lines	Statements	Branches	Functions
	91.64% (307/335)	88.88% (176/198)	100% (81/81)

[github-actions]

Package Size

Platform	Artifact	Base	Head	Delta
React Native	npm tarball	101.6 KiB	102.0 KiB	+487 B

React Native file breakdown

File	Base	Head	Delta
node_modules/@shopify/checkout-kit-protocol/src/generated/Models.ts	85.4 KiB	85.4 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/generated/Models.d.ts	53.0 KiB	53.0 KiB	0 B
ios/AcceleratedCheckoutButtons.swift	14.1 KiB	14.1 KiB	0 B
ios/ShopifyCheckoutKit.swift	13.5 KiB	13.8 KiB	+288 B
android/src/main/java/com/shopify/reactnative/checkoutkit/ShopifyCheckoutKitModule.java	12.8 KiB	13.5 KiB	+688 B
src/components/AcceleratedCheckoutButtons.tsx	13.0 KiB	13.0 KiB	0 B
lib/commonjs/index.js	12.3 KiB	12.3 KiB	0 B
src/index.ts	12.2 KiB	12.2 KiB	0 B
lib/commonjs/components/AcceleratedCheckoutButtons.js	11.4 KiB	11.4 KiB	0 B
lib/commonjs/components/AcceleratedCheckoutButtons.js.map	10.4 KiB	10.4 KiB	0 B
lib/module/components/AcceleratedCheckoutButtons.js	10.2 KiB	10.2 KiB	0 B
lib/module/index.js	10.2 KiB	10.2 KiB	0 B
src/index.d.ts	9.1 KiB	9.9 KiB	+744 B
node_modules/@shopify/checkout-kit-protocol/src/generated/ProtocolNotifications.ts	9.5 KiB	9.5 KiB	0 B
lib/module/components/AcceleratedCheckoutButtons.js.map	9.1 KiB	9.1 KiB	0 B
src/present-dispatcher.ts	8.0 KiB	8.0 KiB	0 B
lib/module/index.js.map	7.9 KiB	7.9 KiB	0 B
lib/commonjs/index.js.map	7.7 KiB	7.7 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/generated/ProtocolNotifications.d.ts	7.6 KiB	7.6 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/generated/ProtocolRenameMap.ts	7.2 KiB	7.2 KiB	0 B
…and 110 smaller files

Measured from the PR base SHA and PR head SHA. The file breakdown shows uncompressed sizes within each package artifact, so individual files do not sum to the compressed artifact total. This comment reports package artifact sizes only; it is not a final app binary-size report.

[bitrise]

Install this build

Open Tophat, select your target device, then click Install. Links open on the Mac running Tophat.

SDK	Install
React Native	Install with Tophat

Checkout Kit E2E results

Status	Suite	Target	Platform	OS version tag	Device
✅	react-native-ios	react-native	ios	latest	iPhone 15 iOS 27 Beta
✅	react-native-android	react-native	android	latest	Google Pixel 9 Android 17.0