fix: reject malformed headers and non-finite timeouts

[OskarEichler]

Fixes

Reject null/array custom header groups and array additionalHeaders with the normal configuration error. Validate finite non-negative timeouts before native conversion. Use every() instead of allocating filtered arrays for header value checks.

Breaking / observable changes

Malformed untyped inputs now fail early, including NaN, Infinity, negative values and false. Zero, positive fractional timeouts, valid maps and omitted options retain their behavior. Existing non-number error text is preserved.

Verification

Actual-source JS controls exercise malformed and valid headers, NaN/Infinity/negative/non-number timeouts, zero, fractional seconds and normal platform conversion.

Each patch was applied independently to upstream commit 6f9090ce1b991c0acc2a6f5dc8bea838deaf4f7a and passed its targeted external actual-source diagnostics or standalone type/lockfile check. The combined fixes pass 75 focused diagnostics. These use synthetic values, controlled native/bridge doubles and disposable filesystem projects, not real credentials.

Combined branch checks:

• Existing Jest suite: 3 suites, 81 tests pass.
• Root lint, demo lint, targeted App.tsx lint, demo TypeScript and standalone public-type checks pass.
• Expo plugin TypeScript build passes. The optional lint:plugin command has a baseline tooling limitation: ESLint 6 does not find its TypeScript-only input.
• Android Debug demo build passes with RN 0.79.2.
• Unsigned iOS Simulator Debug demo build passes with RN 0.79.2.
• Android and iOS production Metro demo bundles pass.
• git diff --check passes.

No checked-in test/spec files were added, changed or disabled. The source changes are supported by external reproducible diagnostics because this audit's repository policy prohibits checked-in test edits. Live OAuth providers, physical-device/browser authentication and a full Expo native build were not exercised. React Doctor reports two warnings: the discovery response is explicitly guarded by response.ok === false, and the demo pending reset is inside finally; both paths are exercised by focused checks. No rules were suppressed.

Scope

• docs/docs/usage/register.md
• packages/react-native-app-auth/index.js
• docs/docs/usage/config.md
• .changeset/appauth-option-validation.md

Unrelated audit fixes are submitted separately. The separate iOS process-global OIDURLSessionProvider request-isolation issue is not claimed fixed by these changes.

[changeset-bot]

🦋 Changeset detected

Latest commit: 75ab2d7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
react-native-app-auth	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

@OskarEichler is attempting to deploy a commit to the Nearform Team on Vercel.

A member of the Team first needs to authorize it.