SupportBlog
Changelog
Back to All
Improved

Checkout SDK Updates — iOS v1.7.0, React Native v1.4.0

November 2nd, 2026

iOS — v1.7.0 (2026-10-16)

View on GitHub

Breaking: minimum deployment target is now iOS 16.0 (previously iOS 14.0). Because 1.7.0 is a 1.x release, from: "1.6.1" (SPM) and ~> 1.6 (CocoaPods) resolve to it on the next update — pin .upToNextMinor(from: "1.6.1") or '~> 1.6.0' to stay on 1.6.x. Devices that cannot run iOS 16 (iPhone 7 and earlier, first-gen iPhone SE) cannot adopt it.

Added

  • Custom field validators: register a per-field rule with Spreedly.shared().addValidation(field:) / removeValidation(field:), then run it on Pay with runCustomValidationBeforeSubmit(additionalFields:). The .invalid("…") message shows under the field and in HostedFieldState.errorMessage, fails card tokenize, and clears when the shopper edits. Opt in to on-blur checks via enablingCustomValidationOnBlur() (SwiftUI) / evaluatesCustomValidationOnBlur (UIKit/Obj-C). Card number, CVV, expiry, and createBankAccount are not covered. Objective-C equivalents provided.
  • Expanded billing and shipping catalogue: mount or tokenize email, company, country, phone (and phone parts), street-split address (houseNumberOrName / street / streetLine2), and shipping fields via FormFieldType, AdditionalField, and Express otherFields.
  • Headless length helpers: AdditionalFieldCharLimits, AdditionalFieldCombinedNameLimit, and AdditionalFieldAPISafety.validateCharLimitOnly(field:value:).
  • Third-party licenses: THIRD-PARTY-LICENSES.md added to the package root and every framework zip (Datadog, Stripe, Braintree).
  • updateSubmitLabel (Objective-C): change the keyboard return-key label after init on SPLTextFieldViewController.

Fixed

  • Card brand chip stays visible in dark mode; long validation messages wrap instead of truncating with an ellipsis.
  • Tapping Delete in a hosted field's long-press menu no longer crashes the app; it removes the selected text.
  • Objective-C name keys: createCreditCardObjC… / createBankAccountObjC… now accept first_name / last_name as well as firstName / lastName (snake_case was previously ignored).
  • Framework zips no longer carry leftover signature files that made codesign --verify fail after unzipping.
  • Published sbom.json is now valid CycloneDX 1.5, listing the Datadog, Stripe, and Braintree code compiled into the frameworks plus Forter3DS as an app-supplied dependency.

Changed

  • Breaking: minimum iOS version is now 16.0 (see note above).
  • Breaking: looser client-side field rules — hosted card name accepts any non-blank value, address line 1 no longer needs 5+ characters, and ZIP only checks length beyond the required check. Headless additionalFields accepts blank values and only checks length and email format, so values the SDK used to reject may now return a server error. ZipCodeRule / AddressRule are deprecated — use ValidationUtils.zipCodeRules / addressLine1Rules.
  • Tokenize payload: a mounted hosted field wins over the same additionalFields key; for unmounted fields an additionalFields entry wins even when blank (omit the key to keep the stored form value). First, last, and full name are each sent as entered. Length caps: address and company 500, email 254, country 100, ZIP and phone 15, first + last name 350 combined.
  • Validation feedback: error messages name the exact field (e.g. "Address line 1 is required"), with shipping-prefixed copy for shipping fields. CardFormDropIn Pay stays tappable (disabled only while processing) and shows field errors instead of disabling, announcing them to VoiceOver.

Security

  • When a custom validator throws, the SDK no longer passes the error to its logs or to a logger set with Spreedly.setLogger; only the field name is recorded.

React Native — v1.4.0 (2026-10-28)

View on GitHub

Native SDK pins: Android checkout-android 1.5.0, iOS checkout-ios-package 1.7.0.

Added

  • Catalogue fields + custom validators (thin RN consume layer): expanded FormFieldTypes / AdditionalFields with contact, street-split, and shipping twins (EMAIL, COMPANY, HOUSE_NUMBER_OR_NAME, STREET, phone country/area codes, matching SHIPPING_*). Exported CustomValidatableFields (29 wire keys) plus addValidation / removeValidation / removeAllValidations / runCustomValidationBeforeSubmit that forward to native Spreedly. New SPLTextField prop enableCustomValidationOnBlur (iOS opt-in; Android runs blur validators when registered). Example app catalogue now matches the native SDK demos, and the Integration Guide documents catalogue field constants, merchant custom validators, and CUSTOM_FIELD_VALIDATION.

Fixed

  • Yarn resolutions for Dependabot/audit: axios 1.20.0, basic-ftp 6.2.x, brace-expansion 1.1.21/2.1.7/5.0.12, fast-uri 3.1.8, http-cache-semantics 4.3.0, image-size → [email protected] (Metro-compatible CVE fix), ip-address 10.7.1, moment 2.31.0.

Changed

  • Added the custom validation option; fixed Xcode 27 simulator configurations and security alerts; app distribution workflow fix; iOS minimum deployment target set to 15.