Upgrade Sandwich SDK to 7.13.1

[SpertsyanKM]

Summary

Bumps the Sandwich SDK pin to 7.13.1, which carries the native Qonversion SDKs with restored TLS certificate validation (iOS 6.17.2, Android sdk 9.7.1, No-Codes 1.11.1). The commit is the one produced by the Upgrade Sandwich cascade, cherry-picked into a regular branch so the one-click release.yml flow can be used afterwards.

Linear: DEV-1837

🤖 Generated with Claude Code

https://claude.ai/code/session_01LaLgoRfHyEeVXkmkrwkWip

Summary by CodeRabbit

• Chores
  • Updated the Android and iOS native components to use the latest Sandwich dependency version, 7.13.1.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: qonversion/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d43d0b81-f55e-46be-a16b-dfbfad03f868

📥 Commits

Reviewing files that changed from the base of the PR and between 01b8ddb and 3420935.

📒 Files selected for processing (2)

• android/build.gradle
• qonversion-react-native-sdk.podspec

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• qonversion/go-micro (manual)

Included review availability: 2 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour.

---

📝 Walkthrough

Walkthrough

The native Android and iOS configurations update their Sandwich dependency from version 7.12.0 to 7.13.1.

Changes

Sandwich dependency update

Layer / File(s)	Summary
Update native dependency versions android/build.gradle, qonversion-react-native-sdk.podspec	The Android sandwich dependency and the iOS QonversionSandwich dependency now use version 7.13.1.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 34209

The requested Sandwich upgrade is consistently applied across both native platforms, with no evidenced merge-blocking risk.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore (reviewers only)

❌ Failed checks (2 errors)

Check name	Status	Explanation	Resolution
Behavior And Regression Safety	❌ Error	The Android dependency change introduces an unresolved artifact. android/build.gradle:83 now requests io.qonversion:sandwich:7.13.1. The module declares only google() and mavenCentral() as rep…	Publish io.qonversion:sandwich:7.13.1 to a repository used by the Android module before merging, or configure the module to use the repository that serves that artifact. If the intended Android release is not yet available, change the And…
Rollout And Recovery Evidence	❌ Error	The change affects production runtime behavior. The two changed pins make Android and iOS consumers resolve Sandwich/QonversionSandwich 7.13.1, and the PR states that this restores TLS certificate val…	Add a rollout record before merge. Include Android, iOS, and No-Codes verification for valid and invalid TLS certificates, plus package build and dependency-resolution checks. Define the activation order from merge to release, package publi…

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title identifies the affected system area, Sandwich SDK, and states the behavioral outcome, upgrading it to version 7.13.1. It matches the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security And Tenant Isolation	✅ Passed	PASS. The pull request changes only two dependency declarations: Android io.qonversion:sandwich from 7.12.0 to 7.13.1 and iOS QonversionSandwich from 7.12.0 to 7.13.1. The authoritative di…
Contract And Data Compatibility	✅ Passed	The pull request changes only the Android and iOS Sandwich dependency pins from 7.12.0 to 7.13.1. It does not change public TypeScript APIs, native bridge methods, events, serialized data, queues, dat…

Full details: Behavior And Regression Safety

Explanation

The Android dependency change introduces an unresolved artifact. android/build.gradle:83 now requests io.qonversion:sandwich:7.13.1. The module declares only google() and mavenCentral() as repositories. Maven Central metadata contains 7.12.0 and 7.13.0, but not 7.13.1; direct requests for both the 7.13.1 POM and AAR return HTTP 404. Gradle therefore fails during dependency resolution for Android builds. The iOS QonversionSandwich 7.13.1 version is published, so this failure is specific to the changed Android pin.

Resolution

Publish io.qonversion:sandwich:7.13.1 to a repository used by the Android module before merging, or configure the module to use the repository that serves that artifact. If the intended Android release is not yet available, change the Android pin to the latest available version, currently 7.13.0, and update it again after 7.13.1 is published.

Full details: Rollout And Recovery Evidence

Explanation

The change affects production runtime behavior. The two changed pins make Android and iOS consumers resolve Sandwich/QonversionSandwich 7.13.1, and the PR states that this restores TLS certificate validation in the native SDKs. The PR description provides no concrete verification, activation gates or order, stop signals, rollback, or forward-recovery instructions. The repository has a release/publish path, including a conditional merge-triggered publish workflow, but the PR only says that the release flow will be used afterwards. It does not bound the activation or recovery of this behavior.

Resolution

Add a rollout record before merge. Include Android, iOS, and No-Codes verification for valid and invalid TLS certificates, plus package build and dependency-resolution checks. Define the activation order from merge to release, package publication, and downstream application release. Define stop signals and thresholds for TLS failures, initialization failures, purchase or entitlement failures, and crash regressions. Document a rollback by reverting both pins to 7.12.0 and publishing a higher package version, or document a tested forward-recovery procedure.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Pre-merge checks failed. Please resolve the failing checks before merging.