Mobile SDKs 1.3.1 / 0.4.1Released October 12, 2026

Fix: the StoreKit privacy manifest is valid XML

App Store Connect refused uploads of apps embedding WebmasterIDStoreKit 1.3.0 with ITMS-91056: a comment inside the module's privacy manifest contained "--", which XML forbids. iOS 1.3.1 and webmasterid_flutter 0.4.1 correct the comment and nothing else.

Analytics

Highlights

iOS SDK 1.3.1 (Swift Package Manager) and webmasterid_flutter 0.4.1 (pub.dev). Android SDK 0.3.0 is unchanged.
The privacy declarations are identical to 1.3.0's: Purchase History and User ID, linked to the user, not used for tracking, purpose analytics; no tracking; no required-reason API.
No runtime, API, consent or delivery change. Apps that embed only WebmasterID were not affected.
Every privacy manifest the SDKs ship is now held to a strict XML parser and Apple's schema before release — in the sources, inside the built frameworks, inside the pub archive and in the accepted apps.

Updating

Raise the dependency and upload again. On iOS, Swift Package Manager: from: "1.3.1" — or let from: "1.3.0" resolve to 1.3.1 with File → Packages → Update to Latest Package Versions. In Flutter: flutter pub upgrade webmasterid_flutter (0.4.1 pins the native SDKs), then let Xcode resolve the WebmasterID package to 1.3.1.

The 1.2.0 and 1.3.0 releases stay published and unchanged; both carry the malformed comment, so an app embedding WebmasterIDStoreKit from either must update before its next upload.
Every published version, asset and checksum is immutable; the installation guide names the versions it was verified with.

What this release does not claim

Acceptance by App Store Connect is verified only by a processed upload. The release was verified by anonymous downloads, checksums, a strict parse of every embedded manifest and a clean consumer build; not by an App Store Connect submission of WebmasterID's own.

No change to purchases, App Store notifications or Google Play: those paths are unchanged.
No new event names and no attribution.

Automatic delivery on iOS and Android

The native SDKs now deliver events on their own, the same way on iOS and Android: about 5 seconds after the first queued event, when the app goes to the background, and after the next launch for anything left. An iOS app no longer needs to call flush() to be measured.

iOS SDK 1.3.0 (Swift Package Manager), Android SDK 0.3.0 (webmasterid.com/sdk/maven) and webmasterid_flutter 0.4.0 (pub.dev). Same public channels, no private repository.
One armed delivery about 5 seconds after the first queued event; later events join it and never postpone it. The app goes to the background: delivered at once, best effort.
After the next launch, anything an earlier launch left is delivered once the consent decision is in force — no flush(), no call from your app.
+ 3 more — see the release page

Read release notes →