fix: trigger patch release

[SanthoshCharanBolt]

Description

Dummy PR to cut a new patch release of the SDK. The Release & Publish workflow (.github/workflows/main-release.yml) runs release-it with the conventional-changelog plugin on every push to main; a version bump (and npm publish) only happens when there is a bumping conventional-commit since the last tag. A fix: title yields a patch bump, so on merge this bumps 0.10.0 → 0.10.1 and publishes.

The only change is an HTML comment appended to README.md; no functional/source code is touched.

Testing

No functional changes. CI (lint, typecheck, test, build) covers the change.

Security Review

Important

A security review is required for every PR in this repository to comply with PCI requirements.

• I have considered and reviewed security implications of this PR and included the summary below.

Security Impact Summary

No security impact. The change only appends an HTML comment to README.md and does not touch any payment, tokenization, authentication, telemetry, or data-handling code.

Link to Devin session: https://app.devin.ai/sessions/c195b0702e2f405ba18f77d7d221a75c
Requested by: @SanthoshCharanBolt

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[davidminin]

Low risk as a diff: one HTML comment appended to README.md. The effect on merge is not low, though, since it publishes @boltpay/react-native to npm.

The mechanism described in the PR body checks out. main is still exactly at v0.10.0 with no commits since the tag, squash merge on this repo uses the PR title, and .release-it.json maps fix: to a patch bump. So merging would cut 0.10.1 and publish.

What I cannot verify is why that release is wanted. This PR was opened at 15:49 on 22 July, about 90 minutes before #110 merged and published 0.10.0 at 17:21 that same day. The pipeline cut and published that version on its own, and nothing has landed on main since. Merging this now would publish a 0.10.1 whose only difference from 0.10.0 is an HTML comment in the README.

Two knock-on effects worth weighing first:

• CHANGELOG.md and the GitHub release notes get a "Bug Fixes: trigger patch release" line. fix is not hidden in the preset in .release-it.json, so that sentence is what SDK users see as the reason for 0.10.1.
• The comment stays in README.md after the release, and the next dummy release appends another one.

If a release is genuinely needed now, say why in the description and this is fine to merge as is. If this was a one-off pipeline test from July, closing it is the cleaner outcome. If manual releases are going to be a recurring need, adding workflow_dispatch to .github/workflows/main-release.yml would let you cut one without a commit and without a changelog line that claims a bug fix.

1 finding, 0 nits.

[davidminin]

@SanthoshCharanBolt Review complete: no code problems, but one question about whether the 0.10.1 release is still wanted now that 0.10.0 published on its own back in July. #111 (review)