[rokt-releases]

Preparing for release 5.2.0 from maintenance/5.x.

• Updated package.json to new version
• Updated CHANGELOG.md
• Updated VERSION file

Changelog

Added

• Support named embedded placements and reliable native events (#308)
• Add CNAME and built-in PayPal redirect callback APIs (#303)

Fixed

• Ignore wrongly typed config values and reset recycled embedded views (#318)
• Keep embedded Rokt view at SDK-reported height on New Architecture (#307)
• Render iOS embedded layouts in bridgeless apps (#296)
• Skip explicit Kotlin plugin when AGP registers the kotlin extension (#301)

Changed

• Harden releases from maintenance branches (#323)
• Bump actions/download-artifact from 4.3.0 to 8.0.2 (#322)
• Bump actions/create-github-app-token from 3.2.0 to 3.3.0 in the github-actions-patch-minor group (#321)
• Bump the gradle-patch-minor group in /Rokt.Widget/android with 2 updates (#320)
• Bump com.rokt:roktsdk from 6.1.4 to 6.2.1 in /Rokt.Widget/android in the gradle-patch-minor group (#314)
• Publish only the verified release tarball and split the GitHub release job (#317)
• Bump the github-actions-patch-minor group with 2 updates (#315)
• Upgrade trunk (#310)
• Bump com.rokt:roktsdk from 6.1.3 to 6.1.4 in /Rokt.Widget/android in the gradle-patch-minor group (#309)
• Read release version and notes from step env in publish workflow (#312)
• Scope release publish permissions to the release job (#313)
• Add agent instructions with public repository confidentiality rules (#311)
• Bump com.rokt:roktsdk from 6.1.1 to 6.1.3 in /Rokt.Widget/android in the gradle-patch-minor group (#306)
• Inherit org default PR template (#305)
• Add a path-aware React Native PR gate (#299)
• Bump com.rokt:roktsdk from 6.0.2 to 6.1.1 in /Rokt.Widget/android (#302)
• Bump trunk-io/trunk-action from 1.3.1 to 2.0.0 (#298)
• Upgrade trunk (#300)
• Fix misleading Rokt SDK README integration guides (#295)
• Bump com.rokt:roktsdk from 6.0.1 to 6.0.2 in /Rokt.Widget/android (#294)
• Upgrade trunk (#293)

[paved-road-agent]

🛣️ Rokt Platform Paved Roads Scan Complete

✅ No paved-road issues detected

Scanned files against 7 rules. · Reviewed commit: 33d3e057e2

📜 Scan history (1 scan)

Commit	Time (UTC)	Status	Findings
33d3e05	2026-10-26 17:32:18	✅ success	0

ℹ️ About Rokt Platform Paved Roads Agent

This scan was performed by the Rokt Platform Paved Roads Agent, an automated paved-road standards review tool for pull requests. See the User Guide for details on severity levels, feedback reactions, and scan configuration.

Reply @paved-road-agent help for the list of commands you can run on this PR.

[pr-security-agent]

🔒 Security Scan Complete

✅ No security issues detected

Scanned files against 50 rules. · Reviewed commit: 33d3e057e2

📜 Scan history (1 scan)

Commit	Time (UTC)	Status	Findings
33d3e05	2026-10-26 17:32:23	✅ success	0

ℹ️ About PR Security Agent

This scan was performed by PR Security Agent, an automated security review tool for pull requests. See the User Guide for details on severity levels, feedback reactions, and scan configuration.

Reply @pr-security-agent help for the list of commands you can run on this PR.

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Beyond the inline finding, I checked whether RoktSampleApp has the same stale-lockfile problem. It doesn't: there's no committed lockfile there. VERSION, Rokt.Widget/package.json, the Rokt.Widget lockfile root entries and the new CHANGELOG compare links all use 5.2.0 consistently.

Extended reasoning...

This is a release-prep version bump from 5.1.2 to 5.2.0 across VERSION, package manifests, lockfiles and CHANGELOG.md, with no code changes and no security-sensitive surface. The confirmed inline finding about the stale SDK tarball reference in the ExpoTestApp lockfile means this should not be approved as-is.