Bump Native Deps + Improve CI - #18
Conversation
📝 WalkthroughWalkthroughThe pull request updates native SDK versions to 1.0.0, synchronizes release versioning across platform files, adds scheduled native dependency update automation, and revises Flutter installation documentation. ChangesNative SDK Versioning
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant GitHubCLI
participant NativeDependencyFiles
participant GitHubPullRequest
GitHubActions->>GitHubCLI: Query latest iOS and Android releases
GitHubCLI-->>GitHubActions: Return normalized SDK versions
GitHubActions->>NativeDependencyFiles: Replace outdated podspec and Gradle versions
GitHubActions->>GitHubPullRequest: Commit, push, and create pull request
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/bump-native-deps.yml:
- Around line 80-81: Update the scheduled bump workflow around the branch
variable and git checkout to prevent duplicate pending bump PRs: first detect an
existing open native-dependency bump PR and reuse its branch, or use a stable
branch name that the workflow can update. Only create a new branch when no
pending bump exists, while preserving the current bump and PR creation flow.
- Line 52: Update the dependency-update condition in the workflow to normalize
current and latest iOS/Android versions and compare them semantically,
triggering the existing sed updates only when an upstream version is greater.
Prevent updates when versions are equal or the current dependency is newer,
preserving the existing upgrade commands.
- Around line 29-32: Update the actions/checkout step to set persist-credentials
to false. In the explicit git push step, authenticate Git using the automation
token without storing it during checkout, and scope GH_TOKEN only to the gh
commands rather than the broader workflow or step.
- Around line 56-63: Harden the bump workflow by passing latest/current version
outputs through environment variables instead of interpolating release tags into
generated Bash, and validate all tag-derived values against strict semver before
use. Update the change-summary construction so backticks remain literal rather
than becoming command substitutions, and store the generated PR text in PR_BODY,
passing it to the GitHub CLI as --body "$PR_BODY". Also remove unnecessary
exposure of THUNDERID_AUTOMATION_BOT and GH_TOKEN from checkout or other steps
unless required.
In `@ios/thunderid_flutter.podspec`:
- Line 15: Pin the ThunderID dependency in the podspec to an exact version
instead of the current lower-bound constraint, and update the parser and
replacement logic in the bump-native-deps workflow to recognize and preserve the
exact-version format when bumping it.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: ee77c50d-0026-45bf-aa21-f65cee890f3a
📒 Files selected for processing (5)
.github/workflows/bump-native-deps.yml.github/workflows/release.ymlREADME.mdandroid/build.gradleios/thunderid_flutter.podspec
| - name: 📥 Checkout Code | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | ||
| with: | ||
| token: ${{ secrets.THUNDERID_AUTOMATION_BOT }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow files ---'
git ls-files '.github/workflows/*'
printf '%s\n' '--- target workflow outline ---'
if command -v ast-grep >/dev/null 2>&1; then
ast-grep outline .github/workflows/bump-native-deps.yml || true
fi
printf '%s\n' '--- target workflow, numbered relevant sections ---'
cat -n .github/workflows/bump-native-deps.yml | sed -n '1,120p'
printf '%s\n' '--- checkout and credential configuration references ---'
rg -n --glob '*.yml' --glob '*.yaml' 'actions/checkout|persist-credentials|THUNDERID_AUTOMATION_BOT|GH_TOKEN|GITHUB_TOKEN|git push|gh ' .githubRepository: thunder-id/flutter-sdks
Length of output: 7471
🏁 Script executed:
#!/bin/bash
set -eu
cat -n .github/workflows/bump-native-deps.yml | sed -n '1,120p'
rg -n --glob '*.yml' --glob '*.yaml' 'actions/checkout|persist-credentials|THUNDERID_AUTOMATION_BOT|GH_TOKEN|GITHUB_TOKEN|git push|gh ' .githubRepository: thunder-id/flutter-sdks
Length of output: 7122
🏁 Script executed:
#!/bin/bash
set -eu
ref='34e114876b0b11c390a56381ad16ebd13914f8d5'
base="https://raw.githubusercontent.com/actions/checkout/$ref"
printf '%s\n' '--- pinned action.yml ---'
curl -fsSL "$base/action.yml" | sed -n '1,180p'
printf '%s\n' '--- pinned authentication helper ---'
curl -fsSL "$base/src/git-auth-helper.ts" | sed -n '1,240p'Repository: thunder-id/flutter-sdks
Length of output: 13265
🏁 Script executed:
#!/bin/bash
set -eu
ref='34e114876b0b11c390a56381ad16ebd13914f8d5'
base="https://raw.githubusercontent.com/actions/checkout/$ref"
curl -fsSL "$base/action.yml" | sed -n '1,180p'
curl -fsSL "$base/src/git-auth-helper.ts" | sed -n '1,240p'Repository: thunder-id/flutter-sdks
Length of output: 13202
Disable checkout credential persistence.
actions/checkout defaults persist-credentials to true and writes the supplied token to local Git configuration. Set persist-credentials: false, then authenticate Git only for the explicit git push. Scope GH_TOKEN only to the gh commands.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 29-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/bump-native-deps.yml around lines 29 - 32, Update the
actions/checkout step to set persist-credentials to false. In the explicit git
push step, authenticate Git using the automation token without storing it during
checkout, and scope GH_TOKEN only to the gh commands rather than the broader
workflow or step.
Source: Linters/SAST tools
|
|
||
| - name: ✏️ Apply Bumps | ||
| id: apply | ||
| if: steps.versions.outputs.current_ios != steps.versions.outputs.latest_ios || steps.versions.outputs.current_android != steps.versions.outputs.latest_android |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=".github/workflows/bump-native-deps.yml"
wc -l "$file"
cat -n "$file" | sed -n '1,110p'
printf '\n--- version-related references ---\n'
rg -n -C 3 'current_ios|latest_ios|current_android|latest_android|releases/latest|bump' .github README.md package.json 2>/dev/null || trueRepository: thunder-id/flutter-sdks
Length of output: 14752
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- pinned dependency declarations ---'
cat -n ios/thunderid_flutter.podspec | sed -n '1,100p'
cat -n android/build.gradle | sed -n '1,100p'
printf '%s\n' '--- standalone comparison verifier ---'
python3 - <<'PY'
import re
from pathlib import Path
from urllib.request import Request, urlopen
import json
ios = Path("ios/thunderid_flutter.podspec").read_text()
android = Path("android/build.gradle").read_text()
current_ios = re.search(r"ThunderID', '>= ([0-9]+\.[0-9]+\.[0-9]+)'", ios).group(1)
current_android = re.search(r"com\.github\.thunder-id:android-sdks:v([0-9]+\.[0-9]+\.[0-9]+)", android).group(1)
def latest(repo):
req = Request(
f"https://api.github.com/repos/{repo}/releases/latest",
headers={"Accept": "application/vnd.github+json", "User-Agent": "read-only-review-check"},
)
with urlopen(req, timeout=10) as response:
return json.load(response)["tag_name"]
def normalized(value):
parts = value.removeprefix("v").split(".")
return tuple(int(re.match(r"\d+", part).group()) for part in parts[:3])
for name, repo, current in [
("iOS", "thunder-id/ios-sdks", current_ios),
("Android", "thunder-id/android-sdks", current_android),
]:
try:
tag = latest(repo)
latest_version = tag.removeprefix("v")
print(f"{name}: current={current}, latest_tag={tag}, normalized_current={normalized(current)}, normalized_latest={normalized(latest_version)}, current_gt_latest={normalized(current) > normalized(latest_version)}")
except Exception as exc:
print(f"{name}: current={current}, latest_lookup_error={type(exc).__name__}: {exc}")
print("synthetic_downgrade_case:")
current, latest = "2.10.0", "2.9.0"
print(f"string_inequality={current != latest}, normalized_current_gt_latest={normalized(current) > normalized(latest)}")
PYRepository: thunder-id/flutter-sdks
Length of output: 3957
Apply only dependency upgrades.
If the current version is greater than the upstream releases/latest version, the inequality checks still run the sed commands and downgrade the dependency. Compare normalized semantic versions and update only when the upstream version is greater.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/bump-native-deps.yml at line 52, Update the
dependency-update condition in the workflow to normalize current and latest
iOS/Android versions and compare them semantically, triggering the existing sed
updates only when an upstream version is greater. Prevent updates when versions
are equal or the current dependency is newer, preserving the existing upgrade
commands.
| if [ "${{ steps.versions.outputs.current_ios }}" != "${{ steps.versions.outputs.latest_ios }}" ]; then | ||
| sed -i "s/ThunderID', '>= ${{ steps.versions.outputs.current_ios }}'/ThunderID', '>= ${{ steps.versions.outputs.latest_ios }}'/" ios/thunderid_flutter.podspec | ||
| changed+=("iOS \`ThunderID\` ${{ steps.versions.outputs.current_ios }} → ${{ steps.versions.outputs.latest_ios }}") | ||
| fi | ||
|
|
||
| if [ "${{ steps.versions.outputs.current_android }}" != "${{ steps.versions.outputs.latest_android }}" ]; then | ||
| sed -i "s/com.github.thunder-id:android-sdks:v${{ steps.versions.outputs.current_android }}/com.github.thunder-id:android-sdks:v${{ steps.versions.outputs.latest_android }}/" android/build.gradle | ||
| changed+=("Android \`android-sdks\` ${{ steps.versions.outputs.current_android }} → ${{ steps.versions.outputs.latest_android }}") |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow files ---'
git ls-files '.github/workflows/*'
printf '%s\n' '--- workflow outline ---'
wc -l .github/workflows/bump-native-deps.yml
printf '%s\n' '--- relevant workflow ---'
cat -n .github/workflows/bump-native-deps.yml
printf '%s\n' '--- relevant identifiers ---'
rg -n -C 3 'current_ios|latest_ios|current_android|latest_android|PR_BODY|pull_request|create-pull|checkout|token|summary|git push|sed -i' .github/workflowsRepository: thunder-id/flutter-sdks
Length of output: 19257
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import subprocess
from textwrap import dedent
def run(label, script):
p = subprocess.run(["bash", "-c", script], text=True, capture_output=True)
print(f"--- {label} ---")
print(f"exit={p.returncode}")
print("stdout:")
print(p.stdout.rstrip())
print("stderr:")
print(p.stderr.rstrip())
# Model the Apply Bumps script after GitHub expression interpolation.
# The synthetic payload is harmless and only prints a marker.
crafted_latest = "1.2.3$(printf APPLY_INJECTION >&2)"
apply_script = dedent(f'''\
changed=()
changed+=("iOS \\`ThunderID\\` 1.0.0 → {crafted_latest}")
printf 'changed=%s\\n' "${{changed[0]}}"
''')
run("crafted latest release value in Apply Bumps", apply_script)
# Model line 88 after normal summary output interpolation.
summary = "iOS `ThunderID` 1.0.0 → 1.0.1"
pr_script = dedent(f'''\
set -u
capture() {{ printf 'body=<%s>\\n' "$1"; }}
capture "{summary}"
''')
run("ordinary summary value in PR step", pr_script)
# Test whether representative shell metacharacters are accepted in Git tag refs.
for tag in [
"v1.2.3$(printf TAG_INJECTION)",
"v1.2.3`printf TAG_INJECTION`",
'v1.2.3"printf TAG_INJECTION"',
"v1.2.3;printf TAG_INJECTION",
]:
p = subprocess.run(
["git", "check-ref-format", f"refs/tags/{tag}"],
text=True, capture_output=True
)
print(f"tag={tag!r} accepted={p.returncode == 0}")
PYRepository: thunder-id/flutter-sdks
Length of output: 624
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import subprocess
base = "v1.2.3"
candidates = [
base,
base + "$X",
base + "(",
base + ")",
base + "$(",
base + "$()",
base + "`",
base + "'",
base + '"',
base + ";",
base + "|",
base + "&",
base + "#",
base + ",",
base + "=",
base + "@",
base + "{",
base + "}",
base + "$X;",
base + '";',
base + "`;",
]
for value in candidates:
p = subprocess.run(
["git", "check-ref-format", f"refs/tags/{value}"],
text=True, capture_output=True
)
print(f"{value!r}: {'accepted' if p.returncode == 0 else 'rejected'}")
# Use a payload only if the Git ref check above shows it is valid.
payloads = [
"v1.2.3$X",
"v1.2.3'",
'v1.2.3"',
"v1.2.3;",
"v1.2.3|",
"v1.2.3&",
]
for tag in payloads:
valid = subprocess.run(
["git", "check-ref-format", f"refs/tags/{tag}"],
capture_output=True
).returncode == 0
if not valid:
continue
# Model interpolation into the double-quoted changed[] assignment.
script = f'''changed=(); changed+=("iOS \\`ThunderID\\` 1.0.0 → {tag}"); printf '%s\\n' "${{changed[0]}}"'''
p = subprocess.run(["bash", "-c", script], text=True, capture_output=True)
print(f"payload {tag!r}: exit={p.returncode}, stdout={p.stdout.strip()!r}, stderr={p.stderr.strip()!r}")
PYRepository: thunder-id/flutter-sdks
Length of output: 1151
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import subprocess
from textwrap import dedent
payloads = [
"1.2.3$(id)",
'1.2.3";id;#',
]
for payload in payloads:
script = dedent(f'''\
if [ "1.0.0" != "{payload}" ]; then
changed=()
changed+=("iOS \\`ThunderID\\` 1.0.0 → {payload}")
printf 'changed=%s\\n' "${{changed[0]}}"
fi
''')
p = subprocess.run(["bash", "-c", script], text=True, capture_output=True)
print(f"--- payload {payload!r} ---")
print(f"exit={p.returncode}")
print("stdout:", p.stdout.rstrip())
print("stderr:", p.stderr.rstrip())
PYRepository: thunder-id/flutter-sdks
Length of output: 584
🌐 Web query:
GitHub actions/checkout persist-credentials default token local git config documentation
💡 Result:
In the GitHub Actions actions/checkout action, the persist-credentials input determines whether the authentication token (or SSH key) used to clone the repository is configured in the Git environment for use by subsequent steps [1][2]. Key details regarding this behavior include: Default Behavior: The default value for persist-credentials is true [1][3][2]. When enabled, the action configures the authentication credentials so that your workflow scripts can run authenticated Git commands (e.g., git fetch, git push) without needing to manually re-authenticate [1][4]. Mechanism: While older versions of the action directly persisted credentials into the local .git/config file [5], newer versions (starting from v6.0.0 and subsequent iterations) have updated the implementation to store these credentials in a separate file under $RUNNER_TEMP [4]. This change was made to enhance security by keeping credentials out of the repository's configuration file [4]. Cleanup: The action includes a post-job cleanup step that automatically removes the persisted credentials, ensuring they do not remain available after the job completes [1][3][2]. Opting Out: If you do not want the action to configure these credentials, you can explicitly disable this behavior by setting the input to false in your workflow file [1][2]: - uses: actions/checkout@v4 with: persist-credentials: false While security concerns have been raised regarding this default behavior [6][7], the mechanism has been updated over time to reduce the risk of accidental exposure [4][6]. It is generally recommended to use the least privilege necessary for your tokens and secrets [3][2].
Citations:
- 1: https://github.com/actions/checkout
- 2: https://github.com/actions/checkout/blob/main/README.md
- 3: https://github.com/marketplace/actions/checkout
- 4: https://github.com/actions/checkout/tree/v6.0.0
- 5: https://github.com/actions/checkout/blob/v2.4.0/README.md
- 6: [security] Escalate concerning default
persist-credentials=trueplease actions/checkout#2312 - 7: Remove
persist-credentialsor change the default tofalseactions/checkout#485
Keep release tag values out of generated Bash.
latest_ios and latest_android come from upstream tag names and are interpolated into Bash at lines 56–63. A valid tag containing $(...) can execute commands during the bump step. The job also exposes THUNDERID_AUTOMATION_BOT to checkout and GH_TOKEN while using write permissions.
Lines 58 and 63 add literal backticks. Line 88 interpolates them into Bash, so ordinary values execute ThunderID or android-sdks command substitutions and corrupt the PR body. Pass outputs through env, validate them against strict semver, and pass the body as --body "$PR_BODY".
🧰 Tools
🪛 zizmor (1.29.0)
[info] 56-56: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 56-56: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 57-57: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 57-57: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 58-58: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 58-58: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 61-61: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 61-61: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 62-62: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 62-62: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 63-63: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 63-63: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/bump-native-deps.yml around lines 56 - 63, Harden the bump
workflow by passing latest/current version outputs through environment variables
instead of interpolating release tags into generated Bash, and validate all
tag-derived values against strict semver before use. Update the change-summary
construction so backticks remain literal rather than becoming command
substitutions, and store the generated PR text in PR_BODY, passing it to the
GitHub CLI as --body "$PR_BODY". Also remove unnecessary exposure of
THUNDERID_AUTOMATION_BOT and GH_TOKEN from checkout or other steps unless
required.
Source: Linters/SAST tools
| branch="chore/bump-native-deps-$(date +%Y%m%d%H%M%S)" | ||
| git checkout -b "$branch" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Avoid duplicate PRs during a pending bump.
The scheduled run reads the default branch. Until an earlier bump PR merges, the default branch still contains the old versions. The next run therefore creates another timestamped branch and another PR for the same update.
Check for an existing open bump PR or reuse a stable branch before creating a new branch.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/bump-native-deps.yml around lines 80 - 81, Update the
scheduled bump workflow around the branch variable and git checkout to prevent
duplicate pending bump PRs: first detect an existing open native-dependency bump
PR and reuse its branch, or use a stable branch name that the workflow can
update. Only create a new branch when no pending bump exists, while preserving
the current bump and PR creation flow.
| s.source_files = 'Classes/**/*' | ||
| s.dependency 'Flutter' | ||
| s.dependency 'ThunderID', '>= 0.2.0' | ||
| s.dependency 'ThunderID', '>= 1.0.0' |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- tracked files ---'
git ls-files 'ios/thunderid_flutter.podspec' '.github/workflows/bump-native-deps.yml'
printf '%s\n' '--- podspec ---'
cat -n ios/thunderid_flutter.podspec
printf '%s\n' '--- updater references ---'
rg -n -C 4 'ThunderID|dependency|pinned|podspec' .github/workflows/bump-native-deps.yml
printf '%s\n' '--- relevant repository references ---'
rg -n -C 3 "s\.dependency.*ThunderID|ThunderID.*1\.0\.0|bump-native-deps|v1\.0\.0" . --glob '!node_modules' --glob '!build' --glob '!dist'Repository: thunder-id/flutter-sdks
Length of output: 4747
🏁 Script executed:
#!/bin/bash
set -e
python3 - <<'PY'
import re
from pathlib import Path
podspec = Path("ios/thunderid_flutter.podspec").read_text()
workflow = Path(".github/workflows/bump-native-deps.yml").read_text()
patterns = {
"current updater parser": r"ThunderID', '>= [0-9]+\.[0-9]+\.[0-9]+'",
"exact constraint": r"ThunderID', '[0-9]+\.[0-9]+\.[0-9]+'",
}
for name, pattern in patterns.items():
print(f"{name}: {bool(re.search(pattern, podspec))}")
parser = re.search(
r'ThunderID\', \'>= ([0-9]+\.[0-9]+\.[0-9]+)\'',
podspec,
)
print("parsed current iOS version:", parser.group(1) if parser else None)
current = "1.0.0"
latest = "1.2.0"
replacement_pattern = f"ThunderID', '>={re.escape(' ' + current)}'"
replacement = f"ThunderID', '>= {latest}'"
updated = re.sub(replacement_pattern, replacement, podspec)
print("current syntax replacement changes file:", updated != podspec)
exact_podspec = podspec.replace(
"ThunderID', '>= 1.0.0'",
"ThunderID', '1.0.0'",
)
exact_parse = re.search(
r"ThunderID', '>= ([0-9]+\.[0-9]+\.[0-9]+)'",
exact_podspec,
)
exact_replace = re.sub(replacement_pattern, replacement, exact_podspec)
print("current parser reads exact syntax:", exact_parse is not None)
print("current replacement updates exact syntax:", exact_replace != exact_podspec)
print("Android exact dependency present:",
"com.github.thunder-id:android-sdks:v1.0.0" in
Path("android/build.gradle").read_text())
PYRepository: thunder-id/flutter-sdks
Length of output: 422
Pin the iOS dependency to an exact version.
The workflow treats native dependencies as pinned, but CocoaPods currently accepts later ThunderID releases. Use an exact constraint and update the parser and replacement in .github/workflows/bump-native-deps.yml.
Proposed constraint change
- s.dependency 'ThunderID', '>= 1.0.0'
+ s.dependency 'ThunderID', '1.0.0'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| s.dependency 'ThunderID', '>= 1.0.0' | |
| s.dependency 'ThunderID', '1.0.0' |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ios/thunderid_flutter.podspec` at line 15, Pin the ThunderID dependency in
the podspec to an exact version instead of the current lower-bound constraint,
and update the parser and replacement logic in the bump-native-deps workflow to
recognize and preserve the exact-version format when bumping it.
2 participants
Purpose
Keep the Flutter plugin's pinned native iOS/Android SDK dependencies from silently going stale, and clean up the README's installation instructions.
Approach
ThunderID(iOS) andandroid-sdks(Android) dependency versions to their current releases.thunder-id/ios-sdksandthunder-id/android-sdksand opens a PR to bump the pins whenever they're behind.pubspec.yaml, so they no longer drift from the actual release version.pub addfor pub.dev, native dependency handling, doc links).Related Issues
Related PRs
Checklist
breaking changelabel added.Security checks