Versions and releases

Every Voidhash SDK and server library is an alpha release: its API can change between builds. Each one installs from the Voidhash package registry, pkg.voidha.sh, or from the Voidhash repository on GitHub. npm still serves an older preview of @voidhash/web, @voidhash/node and @voidhash/react-native (0.0.1-alpha.1-canary.3.3.73d606d) that doesn't match these docs; don't install it.

Packages

A registry build's installed version ends with -g and the short hash of the commit it was built from, such as 0.0.1-alpha.1-g83f7412. Install that build again from https://pkg.voidha.sh/<package>/83f7412. branch:main in place of the hash always names the newest build.

Build retention

Builds on the package registry are kept for three weeks, so pin a recent one and update regularly. Once a build is removed, its URL stops installing, and so does a lockfile that records it, for example in CI. Commits in the GitHub repository don't expire.

Upgrade

1. Read the changelog since your build. Entries marked Breaking need code changes.
2. Install the newer build:
   • Package registry: run the install command again with branch:main or the new hash.
   • Swift Package Manager: change revision: to the new commit. If you follow main, choose File → Packages → Update to Latest Package Versions in Xcode.
   • Repository clone: check out the newer commit in the clone, or move the submodule to it.
3. React Native: ship a new native build. An over-the-air update can't deliver a new SDK version, and must not roll an app back to an earlier one.

Changelog

Notable changes for customers, newest first.

November 2026

Swift, Kotlin and React Native

• setAdDataSharing records whether a person agreed to share their purchases with ad platforms, for sending purchases to Meta.
• Swift credits new installs to Apple Ads campaigns, and Kotlin reads the Google Play install referrer, plus Meta's apps when you set metaAppId. Turn it off with installAttribution.

Web

• playStoreUrl(packageName) builds a Google Play link that carries the visitor's latest campaign into your Android app's install.
• crossSubdomainIdentity keeps one anonymous visitor across your subdomains.
• New $pageleave and $outbound_click events, on by default.

Server libraries

• Methods for organization invitations, Meta measurement settings and automations.

October 2026

Swift, Kotlin and React Native

• Breaking: the SDKs buy and finish purchases themselves by default. Observer mode is off unless you turn it on.
• The React Native SDK runs on the native Swift and Kotlin clients. Upgrading needs a new native build; the identity, queued events and receipts, and the cached person carry over.
• Apps keep working while Voidhash is unreachable. On Swift, purchase(product:) returns .deferred when the store charged but Voidhash hasn't confirmed yet; React Native returns status deferred.
• Kotlin acknowledges a Google Play purchase on the device 48 hours after payment if Voidhash still hasn't confirmed it, so Google Play doesn't refund it.
• Buy App Store promotional offers and Google Play developer offers with an offerId.
• Purchases made from a paywall are credited to that paywall in analytics.
• Analytics consent: analyticsConsent and setAnalyticsConsent stop analytics for a person without affecting purchases.
• isAnonymousDistinctId is exported from the Swift and React Native SDKs.

Web

• The SDK records page views, sessions and campaign attribution, and installs from the package registry.
• A script-tag build for sites without a bundler.
• analytics.beforeSend, analytics.sanitizeUrl and pauseAnalytics() let you change, drop or pause events. With analyticsConsentSource: "app", your consent tool's answer is the only source.
• Breaking: createCheckout(), redirectToCheckout() and getStripeClientReferenceId() are removed. Put getDistinctId() on the checkout your server creates; see Sell on the web.

Every client SDK

• Breaking: new anonymous IDs look like vh_anon_<uuid>. IDs stored by earlier builds keep their old form and stay anonymous; check both with isAnonymousDistinctId.
• The publishable key alone decides the environment; the SDKs no longer send one.

Server libraries

• The Node.js library installs from the package registry.
• The libraries follow the redesigned REST API: methods are grouped and named after its endpoint groups and operations.
• Payment sources can report subscriptions, and provider endpoints answer test requests.
• Breaking: provider endpoints no longer handle checkout.create. Your server creates checkouts at your payment provider.

CLI

• voidhash login signs in with a code you confirm in the browser, and the CLI acts as you.
• Commands for every area of Studio, with keys, webhooks and store mappings per environment.

September 2026

Swift, Kotlin and React Native

• Offline-first: reads answer from the device cache, and purchases, receipts and events queue until Voidhash is reachable.
• Automatic screen tracking, app lifecycle events and analytics sessions.
• Restores keep the purchase with the person who made it, through reinstalls and upgrades.
• Paywalls render natively, with multi-screen flows.
• React Native no longer depends on AsyncStorage, expo-constants or expo-linking.

Next steps

• Install an SDK with the quickstart
• Install an SDK
• Check the go-live checklist