crdt_sync_flutter: latest stable, exact pins, and the gate that keeps it there

Exact-pins every registry dependency (crypto 3.0.7, google_sign_in 7.2.0,
http 1.6.0, shared_preferences 2.5.5, url_launcher 6.3.2, uuid 4.6.0) and takes
flutter_secure_storage 10.3.1 -> 11.0.0, a major.

The major is safe here for a specific reason, not by assumption. 11.0.0 removes
the algorithms deprecated in v10 and makes data written by them unreadable --
but this package has been on ^10.x throughout, and v10 migrated that data
automatically. It also removes `encryptedSharedPreferences` and
`sharedPreferencesName` from `AndroidOptions`; keystore.dart constructs a bare
`FlutterSecureStorage()` and passes no AndroidOptions at all, so neither is
reachable from here. The remaining break is minSdk 24 / compileSdk 37, which
consuming apps inherit from `flutter.minSdkVersion` (Flutter 3.35 already
raised its own floor to 24) and which fails a Gradle build loudly if wrong.

Analyze clean, 88 tests green, coverage held at 202/202 (100%).

Also installs the dependency-freshness gate in pre-commit -- the first repo to
carry it. Pre-commit only, not CI: the other ten manifests here are not
upgraded yet, and `--all` in CI would be permanently red until they are. The
`files:` regex means a source-only commit makes zero network requests.

Proven in both directions through the hook itself, not just the CLI:
crdt_sync_flutter/pubspec.yaml passes, github_device_auth/pubspec.yaml fails
and names http ^1.2.0 and url_launcher ^6.3.0, and a .dart path is skipped
by the filter.

Version 0.2.1 -> 0.3.0; consumers move their git pins after the tag.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK

.pre-commit-config.yaml

@@ -36,3 +36,24 @@ repos:
         entry: scripts/check_md_naming.sh
         language: system
         files: \.(md|markdown)$
+
+      # Every dependency on its ecosystem's newest STABLE release, exact-pinned
+      # so the question is mechanically answerable at all.
+      #
+      # `files:` is what keeps this cheap: a commit touching only source makes
+      # ZERO network requests, and manifest commits mostly hit a 6h disk cache.
+      #
+      # Runs WITHOUT --strict on purpose. Offline it degrades to the cached
+      # answer and passes with a loud banner; `--no-verify` is banned here, so
+      # a hook that hard-failed on a flaky connection would leave no way to
+      # commit at all. CI, always online, is the strict authority.
+      - id: dependency-freshness
+        name: dependencies on newest stable
+        entry: bash scripts/check_dependency_freshness.sh
+        language: system
+        pass_filenames: true
+        files: >-
+          (pubspec\.(yaml|lock)|pyproject\.toml|requirements.*\.txt|uv\.lock
+          |package\.json|package-lock\.json|pnpm-lock\.yaml
+          |Cargo\.(toml|lock)|go\.(mod|sum)
+          |\.fvmrc|\.nvmrc|\.python-version)$

crdt_sync_flutter/pubspec.yaml

@@ -4,7 +4,7 @@ description: >-
   persisted per-install device id, and a one-call bootstrap. Removes the
   ~150 lines of firebase_backend.dart every consuming app was copying.
 publish_to: 'none'
-version: 0.2.1
+version: 0.3.0
 
 environment:
   sdk: ^3.12.2
@@ -15,10 +15,10 @@ dependencies:
       url: https://github.com/kuhyx/utils
       ref: crdt_sync_dart-v0.11.0
       path: crdt_sync_dart
-  crypto: ^3.0.6
+  crypto: 3.0.7
   flutter:
     sdk: flutter
-  flutter_secure_storage: ^10.3.1
+  flutter_secure_storage: 11.0.0
   # A real dependency, not a dev one: lib/testing/ ships the keystore fake so
   # consuming apps can test their own sync wiring without rebuilding it.
   flutter_test:
@@ -26,12 +26,12 @@ dependencies:
   # The one-tap Google plugin. Android/iOS/web only -- there is no Linux
   # implementation -- so desktop reaches Google through the loopback flow in
   # google_desktop_sign_in.dart instead. See google_platform.dart.
-  google_sign_in: ^7.2.0
-  http: ^1.6.0
-  shared_preferences: ^2.5.3
+  google_sign_in: 7.2.0
+  http: 1.6.0
+  shared_preferences: 2.5.5
   # Opens the system browser for the desktop loopback sign-in.
-  url_launcher: ^6.3.1
-  uuid: ^4.5.1
+  url_launcher: 6.3.2
+  uuid: 4.6.0
 
 dev_dependencies:
   very_good_analysis: ^10.3.0