From 1c98d39ddb2982e37751bee4871f6f280ab019f2 Mon Sep 17 00:00:00 2001 From: Krzysztof kuhy Rudnicki Date: Fri, 28 Aug 2026 13:09:41 +0200 Subject: [PATCH] crdt_sync_flutter: latest stable, exact pins, and the gate that keeps it there Exact-pins every registry dependency (crypto 3.0.7, google_sign_in 7.2.0, http 1.6.0, shared_preferences 2.5.5, url_launcher 6.3.2, uuid 4.6.0) and takes flutter_secure_storage 10.3.1 -> 11.0.0, a major. The major is safe here for a specific reason, not by assumption. 11.0.0 removes the algorithms deprecated in v10 and makes data written by them unreadable -- but this package has been on ^10.x throughout, and v10 migrated that data automatically. It also removes `encryptedSharedPreferences` and `sharedPreferencesName` from `AndroidOptions`; keystore.dart constructs a bare `FlutterSecureStorage()` and passes no AndroidOptions at all, so neither is reachable from here. The remaining break is minSdk 24 / compileSdk 37, which consuming apps inherit from `flutter.minSdkVersion` (Flutter 3.35 already raised its own floor to 24) and which fails a Gradle build loudly if wrong. Analyze clean, 88 tests green, coverage held at 202/202 (100%). Also installs the dependency-freshness gate in pre-commit -- the first repo to carry it. Pre-commit only, not CI: the other ten manifests here are not upgraded yet, and `--all` in CI would be permanently red until they are. The `files:` regex means a source-only commit makes zero network requests. Proven in both directions through the hook itself, not just the CLI: crdt_sync_flutter/pubspec.yaml passes, github_device_auth/pubspec.yaml fails and names http ^1.2.0 and url_launcher ^6.3.0, and a .dart path is skipped by the filter. Version 0.2.1 -> 0.3.0; consumers move their git pins after the tag. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK --- .pre-commit-config.yaml | 21 +++++++++++++++++++++ crdt_sync_flutter/pubspec.yaml | 16 ++++++++-------- 2 files changed, 29 insertions(+), 8 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index e4141b7..7823e8d 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -36,3 +36,24 @@ repos: entry: scripts/check_md_naming.sh language: system files: \.(md|markdown)$ + + # Every dependency on its ecosystem's newest STABLE release, exact-pinned + # so the question is mechanically answerable at all. + # + # `files:` is what keeps this cheap: a commit touching only source makes + # ZERO network requests, and manifest commits mostly hit a 6h disk cache. + # + # Runs WITHOUT --strict on purpose. Offline it degrades to the cached + # answer and passes with a loud banner; `--no-verify` is banned here, so + # a hook that hard-failed on a flaky connection would leave no way to + # commit at all. CI, always online, is the strict authority. + - id: dependency-freshness + name: dependencies on newest stable + entry: bash scripts/check_dependency_freshness.sh + language: system + pass_filenames: true + files: >- + (pubspec\.(yaml|lock)|pyproject\.toml|requirements.*\.txt|uv\.lock + |package\.json|package-lock\.json|pnpm-lock\.yaml + |Cargo\.(toml|lock)|go\.(mod|sum) + |\.fvmrc|\.nvmrc|\.python-version)$ diff --git a/crdt_sync_flutter/pubspec.yaml b/crdt_sync_flutter/pubspec.yaml index c379c49..7aede49 100644 --- a/crdt_sync_flutter/pubspec.yaml +++ b/crdt_sync_flutter/pubspec.yaml @@ -4,7 +4,7 @@ description: >- persisted per-install device id, and a one-call bootstrap. Removes the ~150 lines of firebase_backend.dart every consuming app was copying. publish_to: 'none' -version: 0.2.1 +version: 0.3.0 environment: sdk: ^3.12.2 @@ -15,10 +15,10 @@ dependencies: url: https://github.com/kuhyx/utils ref: crdt_sync_dart-v0.11.0 path: crdt_sync_dart - crypto: ^3.0.6 + crypto: 3.0.7 flutter: sdk: flutter - flutter_secure_storage: ^10.3.1 + flutter_secure_storage: 11.0.0 # A real dependency, not a dev one: lib/testing/ ships the keystore fake so # consuming apps can test their own sync wiring without rebuilding it. flutter_test: @@ -26,12 +26,12 @@ dependencies: # The one-tap Google plugin. Android/iOS/web only -- there is no Linux # implementation -- so desktop reaches Google through the loopback flow in # google_desktop_sign_in.dart instead. See google_platform.dart. - google_sign_in: ^7.2.0 - http: ^1.6.0 - shared_preferences: ^2.5.3 + google_sign_in: 7.2.0 + http: 1.6.0 + shared_preferences: 2.5.5 # Opens the system browser for the desktop loopback sign-in. - url_launcher: ^6.3.1 - uuid: ^4.5.1 + url_launcher: 6.3.2 + uuid: 4.6.0 dev_dependencies: very_good_analysis: ^10.3.0