feat(card): patch react-native-wallet with merged Apple Wallet APIs

[wachunei]

Description

Replace the @expensify/react-native-wallet@0.1.24 patch-package file with a Yarn patch of the MetaMask fork at 0.1.41. The patch is the local merge of react-native-wallet#1 and react-native-wallet#2 onto fork main.

That gives the installed library primaryAccountIdentifier and deviceType on Apple provisioning, plus canAddCardToAppleWallet, listAppleWalletPasses, and activateAppleWalletPass. Card provisioning still calls the existing add-card API. The new functions are available for a follow-up to use.

Changelog

CHANGELOG entry: null

Related issues

Fixes: none — no MetaMask Mobile issue tracks this library patch
Refs: MetaMask/react-native-wallet#1
Refs: MetaMask/react-native-wallet#2

Manual testing steps

Feature: Apple Wallet card provisioning

  Scenario: adding a card still completes after the library bump
    Given I am logged into MetaMask Mobile on an iPhone that can add cards to Apple Wallet
    And I have a MetaMask Card that is not yet in Apple Wallet

    When I add the card to Apple Wallet
    Then the Apple Wallet flow is presented
    And the card is added or I can cancel without the app crashing

Screenshots/Recordings

Before

N/A

After

N/A

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

• I've tested on Android
  • Ideally on a mid-range device; emulator is acceptable
• I've tested with a power user scenario
  • Use these power-user SRPs to import wallets with many accounts and tokens
• I've instrumented key operations with Sentry traces for production performance metrics
  • See trace() for usage and addToken for an example

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Medium Risk
Large native-module bump and a breaking TypeScript change to the addCardToAppleWallet callback; Apple card provisioning paths are sensitive though behavior is intended to stay compatible for existing flows.

Overview
Bumps @expensify/react-native-wallet from 0.1.24 (patch-package) to 0.1.41 via a Yarn patch, replacing the old patches/@expensify+react-native-wallet+0.1.24.patch with .yarn/patches/@expensify-react-native-wallet-npm-0.1.41-50938886af.patch (merged MetaMask fork changes from react-native-wallet PRs #1 and #2).

The patched library extends Apple Wallet / PassKit support: optional primaryAccountIdentifier on add-card data; deviceType (phone / watch / unknown) on the add-pass response and as a fourth argument to the addCardToAppleWallet issuer encrypt callback; and new JS APIs canAddCardToAppleWallet, listAppleWalletPasses, and activateAppleWalletPass (full iOS implementation, Android no-ops or throws). iOS native code adds pass listing, activation, multi-device provisioning hints, and clearer errors when a card is already on all devices.

No app-layer changes in this PR—existing provisioning can keep using addCardToAppleWallet; integrators must update the encrypt callback signature if TypeScript is strict. New APIs are for follow-up work.

^{Reviewed by Cursor Bugbot for commit 8b8df8e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​expensify/​react-native-wallet@​0.1.24 ⏵ 0.1.41	+2		+1	+4

View full report

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Priority	Alert  (click "▶" to expand/collapse)	Action
	Potential code anomaly (AI signal): npm @expensify/react-native-wallet is 66.0% likely to have a medium risk anomaly Notes: No direct indicators of runtime malware (no exfiltration, credential theft, or hidden persistence) are present in this module. However, it performs high-impact build-time supply-chain actions: it executes a shell-based unzip command (execSync) whose arguments depend on caller-provided paths, and it extracts/copies attacker-influenced artifacts into android/libs that are then wired into Gradle via a local Maven repository. If an attacker can influence googleTapAndPaySdkPath or the zip contents during the build, this module can facilitate command injection and/or malicious artifact injection into the Android dependency graph. Confidence: 0.66 Severity: 0.58 From: package.json → npm/@expensify/react-native-wallet@0.1.41 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@expensify/react-native-wallet@0.1.41. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8b8df8e. Configure here.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

⚠️ Performance Test Results

ℹ️ Performance test results are currently non-blocking and will not block this PR.

❌ 5 tests failed · 10 tests · 1 device

📱 Devices tested (1)

Android: Google Pixel 8 Pro (v14.0)

❌ Failed Tests (5)

🔬 App profiling vs main is included under each failed scenario that has a prior baseline.

@metamask-onboarding-team

Account creation after fresh install

Platform	Device	Reason	Recording
Android	Google Pixel 8 Pro (v14.0)	no_performance_metrics	📹 Watch

🔬 App profiling check · Current run 38449686060 · Baseline (last green on main) run 38394791567 @ 29f5440

Summary: ⚠️ 2 metrics over +10%: Slow frames (+20.26 (+296.2%)), Issues (+1 (+50%))

ℹ️ API calls unavailable: Network logs API error: Bad Request

Full metric table (+10% variance rules)

Disclaimer — allowed variance: a +10% margin over the baseline is permitted.

• If Current <= Baseline + 10%, treated as acceptable noise.
• If Current > Baseline + 10%, Current and variance % are highlighted with ⚠️.

Metric	Baseline	Current	Δ
CPU avg	5.69%	5.25%	-0.44 (-7.7%)
CPU max	21.79%	20.45%	-1.34 (-6.1%)
Memory avg	667.6 MB	718.91 MB	+51.31 (+7.7%)
Memory max	767.17 MB	793.05 MB	+25.88 (+3.4%)
Slow frames	6.84%	27.1%	+20.26 (+296.2%) ⚠️
Frozen frames	0%	0%	0 (0%)
ANRs	0	0	0 (0%)
Issues	2	3	+1 (+50%) ⚠️
Critical issues	2	1	-1 (-50%)
App size	402.76 MB	402.82 MB	+0.06 (+0%)

Seedless Onboarding: Apple Login New User

Platform	Device	Reason	Recording
Android	Google Pixel 8 Pro (v14.0)	Timed out	—

Seedless Onboarding: Google Login New User

Platform	Device	Reason	Recording
Android	Google Pixel 8 Pro (v14.0)	Timed out	—

Seedless Onboarding: Telegram Login New User

Platform	Device	Reason	Recording
Android	Google Pixel 8 Pro (v14.0)	Timed out	—

@mm-earn-team

Money Home after fresh wallet creation with empty balance

Platform	Device	Reason	Recording
Android	Google Pixel 8 Pro (v14.0)	Timed out	—

✅ Passed Tests (5)

Test	Platform	Device	Duration	Team	Recording
Measure Cold Start To Onboarding Screen	Android	Google Pixel 8 Pro (v14.0)	1.47s	@metamask-mobile-platform	📹 Watch
Onboarding Import SRP with +50 accounts, SRP 3	Android	Google Pixel 8 Pro (v14.0)	3.91s	@metamask-onboarding-team	📹 Watch
Fresh SRP wallet creation performance	Android	Google Pixel 8 Pro (v14.0)	15.08s	@metamask-onboarding-team	📹 Watch
Money Home after importing SRP with funded balance	Android	Google Pixel 8 Pro (v14.0)	4.79s	@mm-earn-team	📹 Watch
Perps open position and close it	Android	Google Pixel 8 Pro (v14.0)	420.00s	@mm-perps-engineering-team	—

---

Branch: feat/react-native-wallet-fork-patch · Build: E2E · Commit: 02f259b · View full run