Versions and releases

Every Voidhash SDK and server library is an alpha release: its API can change between builds. Each one installs from the Voidhash package registry, pkg.voidha.sh, or from the Voidhash repository on GitHub. npm still serves an older preview of @voidhash/web, @voidhash/node and @voidhash/react-native (0.0.1-alpha.1-canary.3.3.73d606d) that doesn't match these docs; don't install it.

Packages

A registry build's installed version ends with -g and the short hash of the commit it was built from, such as 0.0.1-alpha.1-g83f7412. Install that build again from https://pkg.voidha.sh/<package>/83f7412. branch:main in place of the hash always names the newest build.

Build retention

Builds on the package registry are kept for three weeks, so pin a recent one and update regularly. Once a build is removed, its URL stops installing, and so does a lockfile that records it, for example in CI. Commits in the GitHub repository don't expire.

Upgrade

1. Read the changelog since your build. Entries marked Breaking need code changes.
2. Install the newer build:
   • Package registry: run the install command again with branch:main or the new hash.
   • Swift Package Manager: change revision: to the new commit. If you follow main, choose File → Packages → Update to Latest Package Versions in Xcode.
   • Repository clone: check out the newer commit in the clone, or move the submodule to it.
3. React Native: ship a new native build. An over-the-air update can't deliver a new SDK version, and must not roll an app back to an earlier one.

Changelog

Notable changes for customers, newest first.

November 2026

Swift, Kotlin and React Native

• setAdDataSharing records whether a person agreed to share their purchases with ad platforms, for sending purchases to Meta.
• Swift credits new installs to Apple Ads campaigns, and Kotlin reads the Google Play install referrer, plus Meta's apps when you set metaAppId. Turn it off with installAttribution.

Web

• playStoreUrl(packageName) builds a Google Play link that carries the visitor's latest campaign into your Android app's install.
• crossSubdomainIdentity keeps one anonymous visitor across your subdomains.
• New $pageleave and $outbound_click events, on by default.

Every client SDK

• setGroups replaces all of a person's groups in one call and sends a $groupidentify only for a group that changed.
• identify with the same ID and profile as the last call sends nothing, and signOut() does nothing when nobody is signed in, so both can run every time your app checks its session.
• analyticsWhilePending set to buffer holds events captured while consent is pending in memory and records them when consent is granted. grantConsentOnIdentify lets identify grant a pending consent.
• Analytics consent covers what the SDK observes, not what your app says about a person: person attributes and groups are sent whatever the consent, as identify already was, so flags and cohorts that target them work for people who declined tracking. Events, screens, sessions, ad attribution and agreeing to ad data sharing still need consent. To send nothing before consent, don't make those calls until then.
• Breaking: reset() means the same on every SDK. For a signed-in person it does exactly what signOut() does, including $sign_out and a new session. When nobody is signed in, signOut() does nothing and reset() starts a fresh anonymous person without an event. Before, reset() recorded $sign_out for anonymous people on Swift and Kotlin, recorded none on Web, and on React Native recorded none and kept the session.
• Person attributes named email and name set the person's own email and name on every SDK.
• With analyticsWhilePending set to buffer, a grant records $app_installed or $app_updated before the held events.
• Swift and Kotlin: a manual screen name is trimmed, and a blank screen or event name is ignored and reported as ANALYTICS_EVENT_INVALID. The session ID is empty without analytics consent.
• React Native: setPersonAttributesSync() works in observer mode, attribute calls wait for init() and keep their order after an identify() you didn't await, and a setGroups entry without an id is an INVALID_ARGUMENT error.
• The publishable key is optional. Without one the client is inert, for builds and environments without a Voidhash project.
• Web: identify, signOut, reset, the group methods and setAnalyticsConsent take effect in call order without awaiting each one.

Server libraries

• Methods for organization invitations, Meta measurement settings and automations.

October 2026

Swift, Kotlin and React Native

• Breaking: the SDKs buy and finish purchases themselves by default. Observer mode is off unless you turn it on.
• The React Native SDK runs on the native Swift and Kotlin clients. Upgrading needs a new native build; the identity, queued events and receipts, and the cached person carry over.
• Apps keep working while Voidhash is unreachable. On Swift, purchase(product:) returns .deferred when the store charged but Voidhash hasn't confirmed yet; React Native returns status deferred.
• Kotlin acknowledges a Google Play purchase on the device 48 hours after payment if Voidhash still hasn't confirmed it, so Google Play doesn't refund it.
• Buy App Store promotional offers and Google Play developer offers with an offerId.
• Purchases made from a paywall are credited to that paywall in analytics.
• Analytics consent: analyticsConsent and setAnalyticsConsent stop analytics for a person without affecting purchases.
• isAnonymousDistinctId is exported from the Swift and React Native SDKs.

Web

• The SDK records page views, sessions and campaign attribution, and installs from the package registry.
• A script-tag build for sites without a bundler.
• analytics.beforeSend, analytics.sanitizeUrl and pauseAnalytics() let you change, drop or pause events. With analyticsConsentSource: "app", your consent tool's answer is the only source.
• Breaking: createCheckout(), redirectToCheckout() and getStripeClientReferenceId() are removed. Put getDistinctId() on the checkout your server creates; see Sell on the web.

Every client SDK

• Breaking: new anonymous IDs look like vh_anon_<uuid>. IDs stored by earlier builds keep their old form and stay anonymous; check both with isAnonymousDistinctId.
• The publishable key alone decides the environment; the SDKs no longer send one.

Server libraries

• The Node.js library installs from the package registry.
• The libraries follow the redesigned REST API: methods are grouped and named after its endpoint groups and operations.
• Payment sources can report subscriptions, and provider endpoints answer test requests.
• Breaking: provider endpoints no longer handle checkout.create. Your server creates checkouts at your payment provider.

CLI

• voidhash login signs in with a code you confirm in the browser, and the CLI acts as you.
• Commands for every area of Studio, with keys, webhooks and store mappings per environment.

September 2026

Swift, Kotlin and React Native

• Offline-first: reads answer from the device cache, and purchases, receipts and events queue until Voidhash is reachable.
• Automatic screen tracking, app lifecycle events and analytics sessions.
• Restores keep the purchase with the person who made it, through reinstalls and upgrades.
• Paywalls render natively, with multi-screen flows.
• React Native no longer depends on AsyncStorage, expo-constants or expo-linking.

Next steps

• Install an SDK with the quickstart
• Install an SDK
• Check the go-live checklist