ITMS-91061: Missing privacy manifest
Apple's message looks like this:
ITMS-91061: Missing privacy manifest - Your app includes "Frameworks/FirebaseCore.framework/FirebaseCore", which includes FirebaseCore, an SDK that was identified in the documentation as a privacy-impacting third-party SDK. Starting February 12, 2025, if a new app includes a privacy-impacting SDK, or an app update adds a new privacy-impacting SDK, the SDK must include a privacy manifest file.What it means. Apple keeps a list of commonly used SDKs (Firebase, SDWebImage, Lottie, GoogleUtilities, Alamofire, nanopb and others) that must ship a PrivacyInfo.xcprivacy file. A new app that contains an old version of one of them, or an update that adds one, is refused until the SDK has a manifest.
Where it comes from in React Native. You rarely add these pods yourself: a React Native package pulls them in. The most common cases we see:
SDWebImagebefore 5.18.7, pinned byreact-native-fast-image(unmaintained;@d11/react-native-fast-imageorexpo-imageare current).- Firebase pods before 10.22.0, from an old
@react-native-firebase/*. lottie-iosbefore 4.4.0, from an oldlottie-react-native.
How to fix it. Update the React Native package that depends on the pod, run pod install, and check ios/Podfile.lock for the new version. Look up the chain in Podfile.lock (the PODS section lists who depends on what) to find that package.
One thing that is not the problem. The "hermes" on Apple's list is a 2015 Imgur project, not React Native's Hermes engine; the React Native team confirmed this with Apple.
Find them all. npx nativekeel reads Podfile.lock, lists each SDK that is older than its first release with a manifest, and names the React Native package to update. In our scan, 24 of 116 apps with a Podfile.lock had at least one.
npx nativekeel