feat(renovate): gate Expo SDK updates behind the dependency dashboard

expo, react, react-native and Expo-managed modules (expo-*, @expo/*) are
pinned by the Expo SDK and must be upgraded together via `expo install
--fix`. Individual Renovate update PRs for them risk broken builds, so
group them as "Expo SDK" and require manual dashboard approval.

.github/renovate.json

@@ -44,22 +44,42 @@
       ]
     }
   },
-  "lockFileMaintenance": {
-    "vulnerabilityAlerts": {
-      "enabled": true,
-      "addLabels": ["security", "vulnerability"],
-      "assigneesFromCodeOwners": true,
-      "commitMessageSuffix": " [SECURITY]"
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "addLabels": ["security", "vulnerability"],
+    "assigneesFromCodeOwners": true,
+    "commitMessageSuffix": " [SECURITY]"
+  },
+  "packageRules": [
+    {
+      "description": "Expo SDK coherence: expo, react, react-native and Expo-managed modules are pinned by the Expo SDK and must move together (via `expo install --fix`), so do not raise individual update PRs — group them and require manual approval from the Dependency Dashboard",
+      "matchPackageNames": [
+        "expo",
+        "react",
+        "react-dom",
+        "react-native",
+        "react-native-web",
+        "expo-*",
+        "@expo/*"
+      ],
+      "groupName": "Expo SDK",
+      "dependencyDashboardApproval": true
     },
-    "packageRules": [
-      {
-        "description": "Group minor and patch GitHub Action updates into a single PR",
-        "matchManagers": ["github-actions"],
-        "groupName": "CI dependencies",
-        "groupSlug": "ci-deps",
-        "matchUpdateTypes": ["minor", "patch", "digest", "pin"],
-        "automerge": true
-      }
-    ]
-  }
+    {
+      "description": "Group minor and patch GitHub Action updates into a single PR",
+      "matchManagers": ["github-actions"],
+      "groupName": "CI dependencies",
+      "groupSlug": "ci-deps",
+      "matchUpdateTypes": ["minor", "patch", "digest", "pin"],
+      "automerge": true
+    },
+    {
+      "description": "androidx and other Google-hosted Maven packages resolve from Google's Maven repository (not Maven Central)",
+      "matchDatasources": ["maven"],
+      "registryUrls": [
+        "https://dl.google.com/dl/android/maven2/",
+        "https://repo.maven.apache.org/maven2/"
+      ]
+    }
+  ]
 }

.github/workflows/build-apps.yml

@@ -11,12 +11,6 @@ on:
   push:
     branches: [develop, master]
 
-# Exposed to `expo prebuild` (app.config.js → extra.build) so Settings can show the
-# branch + commit a CI build was made from. EAS cloud builds use EAS_BUILD_* instead.
-env:
-  EXPO_PUBLIC_GIT_BRANCH: ${{ github.head_ref || github.ref_name }}
-  EXPO_PUBLIC_GIT_COMMIT: ${{ github.sha }}
-
 jobs:
   build-android-phone:
     if: (!contains(github.event.head_commit.message, '[skip ci]'))
@@ -39,7 +33,7 @@ jobs:
           swap-storage: false
 
       - name: 📥 Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
@@ -122,7 +116,7 @@ jobs:
           swap-storage: false
 
       - name: 📥 Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
@@ -193,7 +187,7 @@ jobs:
 
     steps:
       - name: 📥 Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
@@ -228,7 +222,7 @@ jobs:
           xcode-version: "26.5"
 
       - name: 🏗️ Setup EAS
-        uses: expo/expo-github-action@b184ff86a3c926240f1b6db41764c83a01c02eef # main
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # main
         with:
           eas-version: latest
           token: ${{ secrets.EXPO_TOKEN }}
@@ -258,7 +252,7 @@ jobs:
 
     steps:
       - name: 📥 Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
@@ -318,7 +312,7 @@ jobs:
 
     steps:
       - name: 📥 Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
@@ -353,7 +347,7 @@ jobs:
           xcode-version: "26.5"
 
       - name: 🏗️ Setup EAS
-        uses: expo/expo-github-action@b184ff86a3c926240f1b6db41764c83a01c02eef # main
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # main
         with:
           eas-version: latest
           token: ${{ secrets.EXPO_TOKEN }}
@@ -386,7 +380,7 @@ jobs:
 
     steps:
       - name: 📥 Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0

.github/workflows/check-lockfile.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: 📥 Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           show-progress: false

.github/workflows/ci-codeql.yml

@@ -24,16 +24,16 @@ jobs:
 
     steps:
       - name: 📥 Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: 🏁 Initialize CodeQL
-        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: ${{ matrix.language }}
           queries: +security-extended,security-and-quality
 
       - name: 🛠️ Autobuild
-        uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
 
       - name: 🧪 Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

.github/workflows/crowdin.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: 📥 Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 

.github/workflows/detect-duplicate.yml

@@ -21,7 +21,7 @@ jobs:
       contents: read
     steps:
       - name: 📥 Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: 🍞 Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0

.github/workflows/linting.yml

@@ -51,7 +51,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
@@ -69,7 +69,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: 🛒 Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           submodules: recursive
@@ -101,7 +101,7 @@ jobs:
 
     steps:
       - name: "📥 Checkout PR code"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           submodules: recursive

.github/workflows/release.yml

@@ -63,7 +63,7 @@ jobs:
 
     steps:
       - name: 📥 Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           submodules: recursive
@@ -88,7 +88,7 @@ jobs:
           bun run submodule-reload
 
       - name: 🏗️ Setup EAS
-        uses: expo/expo-github-action@b184ff86a3c926240f1b6db41764c83a01c02eef # main
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # main
         with:
           eas-version: latest
           token: ${{ secrets.EXPO_TOKEN }}
@@ -182,7 +182,7 @@ jobs:
       actions: read # required for `gh run download` to list/fetch this run's artifacts
     steps:
       - name: 📥 Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           show-progress: false

.github/workflows/trivy-scan.yml

@@ -27,7 +27,7 @@ jobs:
       security-events: write # upload SARIF to code scanning
     steps:
       - name: 📥 Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       # Rotate the DB cache weekly (matches the scheduled scan): cache hits within the week
       # instead of a fresh immutable entry per run, still refreshing the DB every week.
@@ -54,7 +54,7 @@ jobs:
           output: trivy-results.sarif
 
       - name: 📤 Upload results to code scanning
-        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: trivy-results.sarif
           category: trivy-fs

.github/workflows/update-issue-form.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: 📥 Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: "🟢 Setup Node.js"
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

app.config.js

@@ -1,41 +1,3 @@
-const { execFileSync } = require("node:child_process");
-
-// Build metadata, injected into `extra.build` and read at runtime via
-// expo-constants (see utils/version.ts). Sources in priority order:
-// EAS cloud build → GitHub Actions → explicit EXPO_PUBLIC_* → local git → null.
-const git = (args) => {
-  try {
-    return execFileSync("git", args, { stdio: ["ignore", "pipe", "ignore"] })
-      .toString()
-      .trim();
-  } catch {
-    return null;
-  }
-};
-
-const buildMeta = {
-  commit:
-    (
-      process.env.EAS_BUILD_GIT_COMMIT_HASH ||
-      process.env.GITHUB_SHA ||
-      process.env.EXPO_PUBLIC_GIT_COMMIT ||
-      git(["rev-parse", "HEAD"]) ||
-      ""
-    ).slice(0, 7) || null,
-  branch:
-    process.env.EAS_BUILD_GIT_BRANCH ||
-    process.env.GITHUB_HEAD_REF ||
-    process.env.GITHUB_REF_NAME ||
-    process.env.EXPO_PUBLIC_GIT_BRANCH ||
-    git(["rev-parse", "--abbrev-ref", "HEAD"]) ||
-    null,
-  profile:
-    process.env.EAS_BUILD_PROFILE ||
-    process.env.EXPO_PUBLIC_BUILD_PROFILE ||
-    null,
-  builtAt: new Date().toISOString(),
-};
-
 module.exports = ({ config }) => {
   if (process.env.EXPO_TV !== "1") {
     config.plugins.push("expo-background-task");
@@ -60,8 +22,6 @@ module.exports = ({ config }) => {
     androidConfig.googleServicesFile = process.env.GOOGLE_SERVICES_JSON;
   }
 
-  config.extra = { ...config.extra, build: buildMeta };
-
   return {
     ...(Object.keys(androidConfig).length > 0 && { android: androidConfig }),
     ...config,

components/settings/UserInfo.tsx

@@ -1,8 +1,8 @@
+import * as Application from "expo-application";
 import { useAtom } from "jotai";
 import { useTranslation } from "react-i18next";
 import { View, type ViewProps } from "react-native";
 import { apiAtom, userAtom } from "@/providers/JellyfinProvider";
-import { getVersionInfo } from "@/utils/version";
 import { ListGroup } from "../list/ListGroup";
 import { ListItem } from "../list/ListItem";
 
@@ -13,9 +13,10 @@ export const UserInfo: React.FC<Props> = ({ ...props }) => {
   const [user] = useAtom(userAtom);
   const { t } = useTranslation();
 
-  // Graduated build identifier — see utils/version.ts:
-  // dev → "0.54.1 · branch · commit", develop/CI → "0.54.1 · commit", production → "0.54.1 (42)".
-  const { display: version } = getVersionInfo();
+  const version =
+    Application?.nativeApplicationVersion ||
+    Application?.nativeBuildVersion ||
+    "N/A";
 
   return (
     <View {...props}>

providers/JellyfinProvider.tsx

@@ -40,7 +40,6 @@ import {
 } from "@/utils/secureCredentials";
 import { store } from "@/utils/store";
 import { clearTVDiscoverySafely } from "@/utils/tvDiscovery/sync";
-import { APP_VERSION } from "@/utils/version";
 
 interface Server {
   address: string;
@@ -54,7 +53,7 @@ const initialApi = (() => {
       const id = getOrSetDeviceId();
       const deviceName = getDeviceNameSync();
       const jellyfinInstance = new Jellyfin({
-        clientInfo: { name: "Streamyfin", version: APP_VERSION },
+        clientInfo: { name: "Streamyfin", version: "0.54.1" },
         deviceInfo: {
           name: deviceName,
           id,
@@ -136,7 +135,7 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
       const id = getOrSetDeviceId();
       const deviceName = getDeviceNameSync();
       return new Jellyfin({
-        clientInfo: { name: "Streamyfin", version: APP_VERSION },
+        clientInfo: { name: "Streamyfin", version: "0.54.1" },
         deviceInfo: {
           name: deviceName,
           id,
@@ -170,7 +169,7 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
     return {
       authorization: `MediaBrowser Client="Streamyfin", Device=${
         Platform.OS === "android" ? "Android" : "iOS"
-      }, DeviceId="${deviceId}", Version="${APP_VERSION}"`,
+      }, DeviceId="${deviceId}", Version="0.54.1"`,
     };
   }, [deviceId]);
 

utils/version.ts

@@ -1,87 +0,0 @@
-import * as Application from "expo-application";
-import Constants from "expo-constants";
-
-/** Raw marketing version (app.json `version`), e.g. "0.54.1". Exposed so the Jellyfin
- * clientInfo auto-tracks the app version instead of a hardcoded string. */
-export const APP_VERSION = Application.nativeApplicationVersion ?? "unknown";
-
-/** Build metadata injected at build time by `app.config.js` into `extra.build`. */
-export interface BuildMeta {
-  commit?: string | null;
-  branch?: string | null;
-  profile?: string | null;
-  builtAt?: string | null;
-}
-
-export interface VersionInfo {
-  /** Marketing version (CFBundleShortVersionString / android versionName), e.g. "0.54.1". */
-  version: string | null;
-  /** Build number (CFBundleVersion / versionCode), e.g. "42". */
-  build: string | null;
-  /** Short git commit the build was made from, e.g. "a1b2c3d". */
-  commit: string | null;
-  /** Git branch the build was made from, e.g. "develop". */
-  branch: string | null;
-  /** EAS build profile, e.g. "production", "preview", or null for local. */
-  profile: string | null;
-  isDev: boolean;
-  isProduction: boolean;
-  /** Graduated label for the Settings "App version" row (see tiering below). */
-  display: string;
-}
-
-/**
- * Resolve a graduated version string for Settings.
- *
- * Tiering (most → least detailed):
- *  - dev / local build   → `version · branch · commit`   (full context for debugging)
- *  - develop / CI / preview → `version · commit`          (pin the exact source)
- *  - production (store / TestFlight) → `version (build)`   (store-correlatable; the
- *      build number lets TestFlight reports pin a build whose version isn't a
- *      published release. Note: TestFlight and the public App Store ship the same
- *      binary — telling them apart needs a runtime iOS receipt check, intentionally
- *      not done here.)
- */
-export function getVersionInfo(): VersionInfo {
-  // Read native/config values defensively — a version string must never crash Settings
-  // (e.g. a dev build whose native expo-constants is out of sync with the JS).
-  const read = <T>(fn: () => T): T | null => {
-    try {
-      return fn() ?? null;
-    } catch {
-      return null;
-    }
-  };
-
-  const version = read(() => Application.nativeApplicationVersion);
-  const build = read(() => Application.nativeBuildVersion);
-  const meta = (read(() => Constants.expoConfig?.extra?.build) ??
-    {}) as BuildMeta;
-  const commit = meta.commit ?? null;
-  const branch = meta.branch ?? null;
-  const profile = meta.profile ?? null;
-  const isDev = __DEV__ === true;
-  const isProduction =
-    typeof profile === "string" && profile.startsWith("production");
-
-  let display: string;
-  if (isDev) {
-    display = [version ?? "dev", branch, commit].filter(Boolean).join(" · ");
-  } else if (isProduction) {
-    display =
-      version && build ? `${version} (${build})` : (version ?? build ?? "N/A");
-  } else {
-    display = [version, commit].filter(Boolean).join(" · ") || version || "N/A";
-  }
-
-  return {
-    version,
-    build,
-    commit,
-    branch,
-    profile,
-    isDev,
-    isProduction,
-    display,
-  };
-}