chore(deps): Upgrade NitroModules to 0.37.1

[chrispader]

NitroModules 0.36.3 leaves NewDot on the older native runtime, and NitroFetch 1.5.4 does not accept the current NitroModules release. This PR upgrades NitroModules and Nitrogen to 0.37.1, moves NitroFetch to 1.6.2, and regenerates the app's local Nitro bindings. It is held until the separate NitroSQLite 9.8.1 PR merges so the two dependency updates can be reviewed independently.

Explanation of Change

NitroFetch 1.6.2 widens its peer range to include NitroModules 0.37.1. I kept Expensify's Android Cronet certificate-pinning patch, which is specific to this app; its contents did not change, but its versioned filename and documentation reference now match NitroFetch 1.6.2. The certificate-pin maintenance script points to that versioned patch as well.

Nitrogen 0.37.1 adds a FastNative annotation to the generated Android bindings for Expensify's contacts and app-start-time modules. The iOS pod lockfile updates only the NitroModules and NitroFetch versions and their checksums. HybridApp's companion PR pins the same native versions in its separate lockfile.

This branch leaves NitroSQLite at the version currently on main. The SQLite PR updates it to 9.8.1 and removes the local fixes. Once that PR merges, this runtime upgrade can follow without including the SQLite changes in its own diff. Manual native builds are still pending; a focused Android compile stopped before the module task when the build could not obtain its Hermes artifact offline.

Fixed Issues

$ #101472

MOBILE-EXPENSIFY: https://github.com/Expensify/Mobile-Expensify/pull/14131

No separate approved proposal applies to this dependency update.

Tests

Manual device verification is pending.

1. On an iOS build containing the SQLite prerequisite, sign in, open a chat, send a message, force-close and reopen, and verify that the message and sign-in state persist.
2. Repeat the chat and relaunch flow on Android. Open a money request's participant search with device contacts permission granted and verify that contacts appear and can be selected.
3. Deny contacts permission, reopen participant search, and verify that the app shows its permission flow instead of crashing.
4. On each native platform, reconnect after briefly going offline and reopen a chat. Verify that requests complete without a certificate error and that no new errors appear in the JS console.

Offline tests

1. Sign in online, switch to airplane mode, compose a message, and relaunch the native app. Verify that chat history and the pending message remain available.
2. Reconnect and verify that the message sends once without a duplicate or certificate error.

QA Steps

1. In staging builds containing the SQLite prerequisite, send a chat message on iOS and Android, relaunch, and verify that the message and sign-in state persist.
2. On each native platform, open a money request's participant search. With contacts permission granted, verify that device contacts appear; with permission denied, verify that the permission flow appears without a crash.
3. Go offline, compose a message, relaunch, and verify that it remains pending. Reconnect and verify that the message sends once and a new chat request succeeds without a certificate error.

PR Author Checklist

• I linked the correct issue in the ### Fixed Issues section above
• I wrote clear testing steps that cover the changes made in this PR
  • I added steps for local testing in the Tests section
  • I added steps for the expected offline behavior in the Offline steps section
  • I added steps for Staging and/or Production testing in the QA steps section
  • I added steps to cover failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
  • I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
  • I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).
• I included screenshots or videos for tests on all platforms
• I ran the tests on all platforms & verified they passed on:
  • Android: Native
  • Android: mWeb Chrome
  • iOS: Native
  • iOS: mWeb Safari
  • MacOS: Chrome / Safari
• I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
• I followed proper code patterns (see Reviewing the code)
  • I verified that comments were added to code that is not self explanatory
  • I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
  • I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
• If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
• I followed the guidelines as stated in the Review Guidelines
• I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
• If a new CSS style is added I verified that:
  • A similar style doesn't already exist
  • The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))
• If new assets were added or existing ones were modified, I verified that:
  • The assets are optimized and compressed (for SVG files, run npm run compress-svg)
  • The assets load correctly across all supported platforms.
• If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
• If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
• If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
• If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
• If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
  • I verified that all the inputs inside a form are aligned with each other.
  • I added Design label and/or tagged @Expensify/design so the design team can review the changes.
• I added unit tests for any new feature or bug fix in this PR to help automatically prevent regressions in this user flow.
• If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.

Screenshots/Videos

No screenshots or videos are included because the runtime and lockfile changes have no visible UI.

[github-actions]

⚠️ This PR is possibly changing native code and/or updating libraries, it may cause problems with HybridApp. Please check if any patch updates are required in the HybridApp repo and run an AdHoc build to verify that HybridApp will not break. Ask Contributor Plus for help if you are not sure how to handle this. ⚠️

[chrispader]

@MelvinBot create an issue for updating NitroModules to the latest version, and updating it's peer dependencies and other related code. Assign @chrispader and mention the issue in this PR

[MelvinBot]

Created chore(deps): Upgrade NitroModules from 0.36.3 to 0.37.1 (Expensify/App#101472) and assigned it to chrispader.

The issue covers the runtime bump plus everything that follows from it: nitrogen in lockstep at 0.37.1, react-native-nitro-fetch to 1.6.2 for the widened peer range, regenerated ExpensifyNitroUtils bindings, the renamed certificate-pinning patch and its two references, ios/Podfile.lock, and the HybridApp companion lockfile. NitroSQLite is listed as out of scope, pointing at chore(deps): Update NitroSQLite from 9.6.0 to 9.8.0.

Two things worth a look:

• This PR's ### Fixed Issues points at the SQLite issue (chore(deps): Update NitroSQLite from 9.6.0 to 9.8.0), which is the prerequisite it's held on, not the work in this diff. You probably want to swap it to the new issue. I left your description alone rather than editing it.
• react-native-nitro-fetch@1.7.0 is already published, and its peer range (react-native-nitro-modules: >=0.36.1) accepts 0.37.1 too. I noted it as a follow-up on the issue so you can decide whether to take it here or separately.

---

view run

[melvin-bot]

@marufsharifi Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

[marufsharifi]

Reviewer Checklist

• I have verified the author checklist is complete (all boxes are checked off).
• I verified the correct issue is linked in the ### Fixed Issues section above
• I verified testing steps are clear and they cover the changes made in this PR
  • I verified the steps for local testing are in the Tests section
  • I verified the steps for Staging and/or Production testing are in the QA steps section
  • I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
  • I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
• I checked that screenshots or videos are included for tests on all platforms
• I included screenshots or videos for tests on all platforms
• I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
• I verified tests pass on all platforms & I tested again on:
  • Android: HybridApp
  • Android: mWeb Chrome
  • iOS: HybridApp
  • iOS: mWeb Safari
  • MacOS: Chrome / Safari
• If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
• I verified proper code patterns were followed (see Reviewing the code)
  • I verified that comments were added to code that is not self explanatory
  • I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
  • I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
• If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
• I verified that this PR follows the guidelines as stated in the Review Guidelines
• I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
• If a new component is created I verified that:
  • A similar component doesn't exist in the codebase
  • All props are defined accurately
  • The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
  • The only data being stored in the state is data necessary for rendering and nothing else
  • The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
• If a new CSS style is added I verified that:
  • A similar style doesn't already exist
  • The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
• If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
• If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
• If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
• If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
• If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
  • I verified that all the inputs inside a form are aligned with each other.
  • I added Design label and/or tagged @Expensify/design so the design team can review the changes.
• For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
• If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
• I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp

Screen_Recording_20260918_051012_Expensify.Dev.mp4

Android: mWeb Chrome

iOS: HybridApp

Screen.Recording.2026-09-18.at.8.44.24.PM.mov

iOS: mWeb Safari

MacOS: Chrome / Safari