chore: bump @react-native-clipboard/clipboard to 1.16.3

[adnxy]

Pre-upgrade dependency bump for the RN 0.85 migration (safe-chores wave). 1.16.3 is the version validated against RN 0.85 / New Architecture; landing it now on 0.83 lets it soak on main and keeps the eventual RN core bump a version-only diff. The repo's custom patch (adds Android clearString and iOS setStringExpire) applies to 1.16.3 with zero conflicts — the diff content is byte-identical, so the patch file is only renamed +1.16.1 → +1.16.3. ios/Podfile.lock regenerated via local pod install (RNCClipboard 1.16.1 → 1.16.3).

Description

Bumps @react-native-clipboard/clipboard from ^1.16.1 to ^1.16.3 as part of the incremental pre-upgrade dependency work for React Native 0.85, and renames the existing patch file to match the new version (content unchanged; verified it applies cleanly to 1.16.3 with git apply --check).

Verified locally: yarn lint:tsc green, single lockfile resolution at 1.16.3, and all test suites covering the patched clipboard methods pass — app/core/ClipboardManager, RevealPrivateCredential, MultichainAccounts/PrivateKeyList (3 suites, 61 tests), which exercise the custom clearString / setStringExpire patch surface.

Changelog

CHANGELOG entry: null

Related issues

Fixes:

Manual testing steps

1. Copy an address from the wallet home screen and paste it elsewhere — verify clipboard content
2. Reveal SRP / private key and use the copy-to-clipboard flow — on iOS verify the clipboard expires (60s), on Android verify it can be cleared

Screenshots/Recordings

N/A — dependency version bump, no visual changes expected.

Before

N/A

After

N/A

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Low Risk
Patch-level native dependency bump with lockfile-only diffs; clipboard is security-sensitive but behavior should be unchanged if the existing patch still applies cleanly.

Overview
Pre-upgrade dependency work for React Native 0.85: @react-native-clipboard/clipboard is raised from ^1.16.1 to ^1.16.3 in package.json, with yarn.lock resolving 1.16.3 and ios/Podfile.lock updated so RNCClipboard pins 1.16.3 (new pod checksum).

No application source changes in this diff—only the version bump and lockfiles. The repo’s yarn patch for custom clearString (Android) and setStringExpire (iOS) is intended to stay on the new version (rename to 1.16.3 per PR description); app code still goes through ClipboardManager for copy flows on addresses, SRP, and private keys.

^{Reviewed by Cursor Bugbot for commit f036ca8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[metamask-ci]

PR template — items to address before "Ready for review"

Warnings — informational, address before merging:

• Related issues section is empty. Add Fixes: #123 / Closes: <URL> / Refs: <Jira key>, or write a short rationale after the colon.
• Pre-merge author checklist has only 5 of the required 8 items. Every checklist row must be present and consciously checked — do not delete rows.

See docs/readme/ready-for-review.md for the full Definition of Ready for Review.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​react-native-clipboard/​clipboard@​1.16.1 ⏵ 1.16.3

View full report

[adnxy]

SocketSecurity ignore npm/es-toolkit@1.45.1

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: SmokeAccounts, SmokeSnaps, SmokeWalletPlatform
• Selected Performance tags: None (no tests recommended)
• Risk Level: medium
• AI Confidence: 78%

click to see 🤖 AI reasoning details

E2E Test Selection:
The PR bumps @react-native-clipboard/clipboard from ^1.16.1 to ^1.16.3 and renames the patch file accordingly (same patch content). The patch adds setStringExpire (iOS) and clearString (Android) methods to the clipboard library.

Clipboard is used across several critical flows:

1. SmokeAccounts: ClipboardManager is used for SRP copy/reveal flows (COPY_SRP analytics event, ClipboardManager.setStringExpire for timed clipboard clearing of sensitive data). SrpInputGrid directly imports Clipboard.getString() for pasting SRP words during import. These are security-sensitive operations.
2. SmokeSnaps: SnapUICopyable component uses ClipboardManager.setString() for snap copyable UI elements.
3. SmokeWalletPlatform: TokenDetailsList uses ClipboardManager.setString() for copying contract addresses; account address copying flows.

The lock files (yarn.lock, ios/Podfile.lock) are standard dependency resolution updates with no independent functional impact.

This is a minor version bump (patch release) so the risk is medium rather than high - the API surface is stable and the patch content is unchanged. However, clipboard functionality touches security-sensitive flows (SRP handling) which warrants validation.

Performance Test Selection:
The clipboard library bump is a minor version update with no performance-sensitive changes. Clipboard operations are not measured in any performance test scenarios (account list rendering, onboarding, login, swaps, launch, asset loading, predict, perps). No performance tests are warranted.

View GitHub Actions results

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud