Blokada

Recent Commits

• dependabot[bot] (06 Jul 26)

  build(deps): bump anthropics/claude-code-action (#1165) Bumps the github-actions group with 1 update: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action). Updates `anthropics/claude-code-action` from 1.0.159 to 1.0.165 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/a92e7c70a4da9793dc164451d829089dc057a464...558b1d6cab4085c7753fe402c10bef0fbb92ac7a) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.165 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (06 Jul 26)

  build(deps-dev): bump @types/node (#1164) Bumps the appium-wdio-npm group in /automation/appium/wdio with 1 update: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node). Updates `@types/node` from 26.0.1 to 26.1.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: appium-wdio-npm ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (06 Jul 26)

  build(deps): bump the android-gradle group in /android with 2 updates (#1163) Bumps the android-gradle group in /android with 2 updates: androidx.compose:compose-bom and [io.adapty:adapty-bom](https://github.com/adaptyteam/AdaptySDK-Android). Updates `androidx.compose:compose-bom` from 2026.06.00 to 2026.06.01 Updates `io.adapty:adapty-bom` from 3.17.1 to 3.17.2 - [Release notes](https://github.com/adaptyteam/AdaptySDK-Android/releases) - [Commits](https://github.com/adaptyteam/AdaptySDK-Android/compare/3.17.1...3.17.2) --- updated-dependencies: - dependency-name: androidx.compose:compose-bom dependency-version: 2026.06.01 dependency-type: direct:production dependency-group: android-gradle - dependency-name: io.adapty:adapty-bom dependency-version: 3.17.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: android-gradle ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (06 Jul 26)

  build(deps): bump the flutter-dependencies group (#1161) Bumps the flutter-dependencies group in /common with 3 updates: [build_runner](https://github.com/dart-lang/build), [mobx_codegen](https://github.com/mobxjs/mobx.dart) and [mockito](https://github.com/dart-lang/build/tree/master/builder_pkgs). Updates `build_runner` from 2.4.13 to 2.15.0 - [Release notes](https://github.com/dart-lang/build/releases) - [Commits](https://github.com/dart-lang/build/compare/build_runner-v2.4.13...build_runner-v2.15.0) Updates `mobx_codegen` from 2.6.2 to 2.7.7 - [Release notes](https://github.com/mobxjs/mobx.dart/releases) - [Changelog](https://github.com/mobxjs/mobx.dart/blob/main/CHANGELOG.md) - [Commits](https://github.com/mobxjs/mobx.dart/compare/mobx_codegen-2.6.2...mobx_codegen-2.7.7) Updates `mockito` from 5.4.4 to 5.6.4 - [Release notes](https://github.com/dart-lang/build/releases) - [Commits](https://github.com/dart-lang/build/commits/mockito-v5.6.4/builder_pkgs) --- updated-dependencies: - dependency-name: build_runner dependency-version: 2.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: mobx_codegen dependency-version: 2.7.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: mockito dependency-version: 5.6.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Karol Gusak (01 Jul 26)

  test(appium): wave 2 smoke specs — exceptions CRUD, freemium gate, account, activity (#1159) * test(appium): wave 2 smoke specs — exceptions CRUD, freemium gate, account, activity Four functional smoke specs plus the accessibility automation ids they need. Each rides the existing account groups (no extra restore) and self-restores state. - exceptions-crud: add a blocked domain, verify it appears, swipe-delete it. - freemium-gate: assert the Advanced blocklists upgrade gate renders (libre acct). - account-status: assert the Settings header shows an active subscription. - activity: reach the Activity screen via Privacy Pulse -> Show All and render it. App-code changes are layout-neutral Semantics ids only (ids.dart + automationIds.ts mirror, dialog.dart, settings_screen.dart, exception_item.dart [SlidableAction -> CustomSlidableAction for a taggable delete], freemium_screen.dart, settings_section.dart, recent_activity.dart, activity_screen.dart, stats_filter.dart, activity_item.dart). account-status uses Semantics(label:)+ExcludeSemantics to stay readable without a VoiceOver double-announce. Registered in wdio.conf.ts. Verified: flutter analyze (0 errors), flutter test (379 pass), tsc (no new errors). Not yet run on-device. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * test(appium): fix wave 2 ids surfacing + activity scroll; drop freemium-gate On-device run (PR #1159) surfaced 3 failures, all 'automation id not found': - MergeSemantics fix: the new Semantics(identifier:) wrappers on the exception Add button, domain field, Save button, the Activity Show-All + search action, and the search field were bare (no MergeSemantics), so the id landed on a non-leaf container that iOS/WebDriverAgent does not expose as a queryable element (the Add button rendered with label='Add' but no id). Wrap each in MergeSemantics so the id merges onto the leaf node — the proven pattern used by exceptions_tab_*, nav_back, screen_title (and account-status, which passed because ExcludeSemantics made it a single node). - activity: the Recent Activity 'Show All' sits below the fold in the scrolling Privacy Pulse list, so it wasn't in the tree. Scroll the list until it renders before tapping. - freemium-gate: dropped. The libre test account is not isFreemium-gated on Advanced (the page-source showed the full interactive filter list, no FreemiumScreen/CTA), so the scenario's premise doesn't hold for these accounts. Removed the spec, the freemium_cta id (both files), and the freemium_screen.dart Semantics wrapping. Verified: flutter analyze (0 errors), flutter test (379 pass), tsc (no new errors). Still unrun on-device after these fixes. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * test(appium): wrap the real Exceptions Add button + fix activity scroll-to-tap Second on-device run (run 28439068099) left 2 of the re-wrapped specs failing: - exceptions-crud: I had wrapped settings_screen.dart's _getExceptionsAction, which is dead code (its _getAction is gated to Paths.support and the phone settings screen passes no top-bar trailing). The Add button that actually renders on the phone comes from a duplicate _getExceptionsAction in navigation.dart's settingsExceptions route — wrap THAT in MergeSemantics(Semantics(id)); revert the dead settings_screen wrap. (The page-source showed the button as name='Add'.) - activity: the MergeSemantics fix worked (recent_activity_show_all now resolves and was tapped), but on first appearance it sits flush at the bottom edge (y=890 h=6 on an 896-tall screen) so the tap hit the home indicator and didn't navigate. Scroll now continues until the button is comfortably clear of the bottom before tapping. Verified: flutter analyze (0 errors), flutter test (379 pass), tsc (no new errors). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * test(appium): type exception domain via setValue, not driver.keys 3rd on-device run got exceptions-crud past the Add button + dialog (the navigation.dart wrap worked) but failed at typing: driver.keys() sends a W3C key-action batch (all key-downs then all key-ups) that WDA rejects when the string repeats a character ('Key Down action ... must have a closing Key Up successor') — and any real domain repeats letters. setValue types via XCUITest typeText, which has no such limitation. tsc clean. The Save tap + row poll + swipe-delete run on-device for the first time only once typing succeeds, so those remain to be confirmed by the next run. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * test(appium): match exception row label with CONTAINS, not == 4th on-device run: setValue typing worked and the domain was added to the Blocked list, but the verify poll timed out. The exception_item exposes its label as the domain TWICE (an explicit Semantics(label:) plus the child Text, merged by MergeSemantics with a newline: 'domain\ndomain'), and long domains get middle-ellipsized — so 'label == domain' can never match. Use 'label CONTAINS domain' for the verify, delete-target and gone-poll selectors. Add/verify is now confirmed on-device; only the swipe-to-delete remains first-run. tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• Karol Gusak (30 Jun 26)

  test(appium): smoke specs for protection persistence, blocklist toggle, Privacy Pulse range (#1158) Three functional iOS smoke specs, each riding the existing active-account group (no extra cc restore), self-restoring state and leaving protection ON: - cold-restart-persistence: assert protection stays active after a kill+relaunch without re-tapping (state-restoration guard the other active specs mask). - blocklist-toggle: flip the first automation.filter_option.* switch, wait out the ~1s backend debounce, assert the switch flipped, then restore it. Needs the paid account (freemium wraps the filter list in IgnorePointer). - privacy-pulse-range: flip the 24h<->7d toplist range (existing privacy_pulse_range_* ids), restore 24h. Registered in the active group of wdio.conf.ts (cold-restart after dns-onboarding so the DNS profile exists; power-pause still last as resting state). No app-code changes — all use existing automation ids. Not yet run on-device. Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• Karol Gusak (30 Jun 26)

  refactor(v6): remove dead bottom-tab nav and abandoned home-stats widgets (#1157) The V6 bottom tab bar (TabWidget) was superseded by the hub-and-spoke Home layout and never mounted; an abandoned home-stats/chart cluster was never wired into the live Privacy Pulse UI. Both lingered as dead code that repeatedly confused navigation analysis. Deleted: - v6/widget/tab/{tab,tab_bar_compensation}.dart - v6/widget/home/stats/{stats_section,selector,column_chart,radial_segment,totalcounter}.dart Also removed the now-unused nav_home/nav_activity/nav_advanced/nav_settings automation ids (only ever applied inside TabWidget) from ids.dart and its automationIds.ts mirror, plus the orphaned hackyManualPopToFirst() in top_bar.dart (only caller was TabWidget). Refreshed two Appium comments that described the removed code. Preserved: nav_back, TabButtonsWidget/TabItem, the reachable Activity screen, and the AI-explorer nav_* guidance (raw-string LLM hints, still accurate). Verified: flutter analyze (0 errors), flutter test (379 pass), appium harness unit tests (91 pass). Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• Karol Gusak (30 Jun 26)

  perf(appium): restore the test account once per group, not per spec (#1156) Each spec's `before` restored the account via the support-chat command bus (app relaunch + `cc restore <id>` + network round trip, ~1 min) even when the device was already on the right account — that setup is the bulk of the suite's wall-clock (per the JUnit run summary, ~2 min/scenario, almost all setup). ensureAccount{Active,Inactive} now restore only when the device isn't already on that account this run, tracked in output/.account-state via a new driver-free support module. The wdio onPrepare hook resets it once per run, so the first spec always restores (never trusting leftover device state) and later same-group specs skip. With scenarios grouped by account state (all inactive first, then all active — documented in wdio.conf.ts and the README), the account is restored just twice per run instead of five times (~3 fewer restores, ~3 min saved). Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• Karol Gusak (29 Jun 26)

  test(appium): functional smoke specs + JUnit run summary (#1155) * test(appium): add home-nav, settings-nav, and power pause/off smoke specs Adds three functional-flow smoke specs to the iOS Appium suite, covering the gaps left after the paywall golden and DNS-onboarding specs: - tab-navigation: Home hub-and-spoke navigation to Privacy Pulse / Advanced / Settings, asserting each screen body + top-bar title render. The V6 bottom tab bar (nav_* ids) is dead code — TabWidget is never mounted — so this drives the Home hub buttons, matching account.ts::openSettingsScreen. - settings-navigation: opens the Exceptions and Retention sub-pages and asserts the Exceptions tab selection actually flips (graceful fallback if XCUITest does not surface the `selected` trait). - power-pause: completes the activation lifecycle — pause action sheet -> turn off -> assert toggle inactive -> re-activate. activateUntilOn retries the toggle because it reads "inactive" during the reconfiguring (working) window where taps are dropped, and dismisses any stray pause sheet. New flows/nav.ts holds the in-app navigation helpers; flows/home.ts gains the pause-action-sheet helpers. No Flutter / automation-id changes — every id already existed. Specs registered in wdio.conf.ts in account-state order so the device still ends active + protection ON. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * ci(appium): run each smoke scenario as its own step + JUnit summary Splits the single ~14-min "run appium smoke" step into per-scenario steps so each scenario surfaces separately (own pass/fail + duration) and publishes a per-scenario JUnit table to the run summary. One physical device → scenarios still run serially; this is for visibility/diagnosis, not speed. - wdio.conf.ts: WDIO_SPEC selects a single spec; add @wdio/junit-reporter writing one collision-safe file per scenario to output/junit. - Makefile: appium-prepare (build+install the app once, reset junit dir) and appium-run-spec SPEC=... (run one spec, reuse the install via APP_INSTALL=0). appium-test (full local run) is unchanged. - scripts/junit-summary.mjs (+unit test): render output/junit/*.xml as a Markdown table for $GITHUB_STEP_SUMMARY. - appium-smoke.yml: prepare once, one continue-on-error step per scenario, a gate that fails the job if any scenario failed, publish summary, upload junit. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * ci(appium): revert per-scenario steps, keep only the JUnit summary The per-scenario CI steps added ~1-2 min (5x Appium/WDA session startups) purely for visibility. Revert to the single `make appium-test` run and keep just the zero-cost JUnit report: - wdio.conf.ts: keep @wdio/junit-reporter; drop the WDIO_SPEC single-spec selection (the full suite runs again as before). - Makefile: drop appium-prepare / appium-run-spec; appium-test now resets the junit output dir so the summary is fresh each run. - appium-smoke.yml: restore the single smoke step (timeout back to 30m); keep the "Publish per-scenario summary" step and the junit artifact upload. scripts/junit-summary.mjs (+unit test) and the junit dependency are unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * fix(appium): report per-scenario wall-clock in the JUnit summary The summary summed testcase time (the it() body only), giving a misleadingly small total (~3m14s) that didn't match the ~14m smoke step. Use the testsuite time instead — per-scenario wall-clock including before/after hooks (app relaunch + account restore) and per-spec WebDriverAgent startup — and show the test-body time alongside as "Test exec", with a note that the one-time npm + app build/install isn't attributed to a scenario. Also use the unsanitized suiteName property for nicer names. Validated against the real CI junit (total 13m9s, matching the step minus ~1m20s of one-time setup). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• dependabot[bot] (29 Jun 26)

  build(deps): bump the flutter-dependencies group (#1149) Bumps the flutter-dependencies group in /common with 22 updates: | Package | From | To | | --- | --- | --- | | [build_runner](https://github.com/dart-lang/build) | `2.4.13` | `2.15.0` | | [adapty_flutter](https://github.com/adaptyteam/AdaptySDK-Flutter) | ``3755e27`` | `3.17.0` | | [test_api](https://github.com/dart-lang/test/tree/master/pkgs) | `0.7.6` | `0.7.11` | | [meta](https://github.com/dart-lang/sdk/tree/main/pkg) | `1.16.0` | `1.18.0` | | [mobx_codegen](https://github.com/mobxjs/mobx.dart) | `2.6.2` | `2.7.4` | | [mockito](https://github.com/dart-lang/build/tree/master/builder_pkgs) | `5.4.4` | `5.6.4` | | [dependency_validator](https://github.com/Workiva/dependency_validator) | `4.1.3` | `5.0.5` | | [cached_network_image](https://github.com/Baseflow/flutter_cached_network_image) | `3.4.0` | `3.4.1` | | [crypto](https://github.com/dart-lang/core/tree/main/pkgs) | `3.0.6` | `3.0.7` | | [cupertino_icons](https://github.com/flutter/packages/tree/main/third_party/packages) | `1.0.8` | `1.0.9` | | [flex_color_scheme](https://github.com/rydmike/flex_color_scheme) | `8.3.1` | `8.4.0` | | [flutter_chat_core](https://github.com/flyerhq/flutter_chat_ui) | `2.6.2` | `2.9.0` | | [flutter_chat_ui](https://github.com/flyerhq/flutter_chat_ui) | `2.6.1` | `2.11.1` | | [flutter_slidable](https://github.com/letsar/flutter_slidable) | `4.0.0` | `4.0.3` | | [http](https://github.com/dart-lang/http/tree/master/pkgs) | `1.4.0` | `1.6.0` | | [logger](https://github.com/SourceHorizon/logger) | `2.5.0` | `2.7.0` | | [mobx](https://github.com/mobxjs/mobx.dart) | `2.5.0` | `2.6.0` | | [mobx_codegen](https://github.com/mobxjs/mobx.dart) | `2.6.2` | `2.7.7` | | [mocktail](https://github.com/felangel/mocktail) | `1.0.4` | `1.0.5` | | [provider](https://github.com/rrousselGit/provider) | `6.1.5` | `6.1.5+1` | | [string_validator](https://github.com/suragch/string_validator) | `1.1.0` | `1.2.0` | | [syncfusion_flutter_charts](https://github.com/syncfusion/flutter-widgets/tree/master/packages) | `33.2.12` | `33.2.15` | Updates `build_runner` from 2.4.13 to 2.15.0 - [Release notes](https://github.com/dart-lang/build/releases) - [Commits](https://github.com/dart-lang/build/compare/build_runner-v2.4.13...build_runner-v2.15.0) Updates `adapty_flutter` from `3755e27` to 3.17.0 - [Release notes](https://github.com/adaptyteam/AdaptySDK-Flutter/releases) - [Changelog](https://github.com/adaptyteam/AdaptySDK-Flutter/blob/master/CHANGELOG.md) - [Commits](https://github.com/adaptyteam/AdaptySDK-Flutter/commits/3.17.0) Updates `test_api` from 0.7.6 to 0.7.11 - [Release notes](https://github.com/dart-lang/test/releases) - [Commits](https://github.com/dart-lang/test/commits/test_api-v0.7.11/pkgs) Updates `meta` from 1.16.0 to 1.18.0 - [Changelog](https://github.com/dart-lang/sdk/blob/main/CHANGELOG.md) - [Commits](https://github.com/dart-lang/sdk/commits/1.18.0/pkg) Updates `mobx_codegen` from 2.6.2 to 2.7.4 - [Release notes](https://github.com/mobxjs/mobx.dart/releases) - [Changelog](https://github.com/mobxjs/mobx.dart/blob/main/CHANGELOG.md) - [Commits](https://github.com/mobxjs/mobx.dart/compare/mobx_codegen-2.6.2...mobx_codegen-2.7.4) Updates `mockito` from 5.4.4 to 5.6.4 - [Release notes](https://github.com/dart-lang/build/releases) - [Commits](https://github.com/dart-lang/build/commits/mockito-v5.6.4/builder_pkgs) Updates `dependency_validator` from 4.1.3 to 5.0.5 - [Release notes](https://github.com/Workiva/dependency_validator/releases) - [Changelog](https://github.com/Workiva/dependency_validator/blob/master/CHANGELOG.md) - [Commits](https://github.com/Workiva/dependency_validator/commits/5.0.5) Updates `cached_network_image` from 3.4.0 to 3.4.1 - [Release notes](https://github.com/Baseflow/flutter_cached_network_image/releases) - [Commits](https://github.com/Baseflow/flutter_cached_network_image/compare/v3.4.0...v3.4.1) Updates `crypto` from 3.0.6 to 3.0.7 - [Release notes](https://github.com/dart-lang/core/releases) - [Commits](https://github.com/dart-lang/core/commits/crypto-v3.0.7/pkgs) Updates `cupertino_icons` from 1.0.8 to 1.0.9 - [Commits](https://github.com/flutter/packages/commits/cupertino_icons-v1.0.9/third_party/packages) Updates `flex_color_scheme` from 8.3.1 to 8.4.0 - [Release notes](https://github.com/rydmike/flex_color_scheme/releases) - [Changelog](https://github.com/rydmike/flex_color_scheme/blob/master/CHANGELOG.md) - [Commits](https://github.com/rydmike/flex_color_scheme/compare/8.3.1...8.4.0) Updates `flutter_chat_core` from 2.6.2 to 2.9.0 - [Release notes](https://github.com/flyerhq/flutter_chat_ui/releases) - [Commits](https://github.com/flyerhq/flutter_chat_ui/commits/v2.9.0) Updates `flutter_chat_ui` from 2.6.1 to 2.11.1 - [Release notes](https://github.com/flyerhq/flutter_chat_ui/releases) - [Commits](https://github.com/flyerhq/flutter_chat_ui/commits) Updates `flutter_slidable` from 4.0.0 to 4.0.3 - [Release notes](https://github.com/letsar/flutter_slidable/releases) - [Changelog](https://github.com/letsar/flutter_slidable/blob/master/CHANGELOG.md) - [Commits](https://github.com/letsar/flutter_slidable/commits) Updates `http` from 1.4.0 to 1.6.0 - [Release notes](https://github.com/dart-lang/http/releases) - [Commits](https://github.com/dart-lang/http/commits/HEAD/pkgs) Updates `logger` from 2.5.0 to 2.7.0 - [Release notes](https://github.com/SourceHorizon/logger/releases) - [Changelog](https://github.com/SourceHorizon/logger/blob/main/CHANGELOG.md) - [Commits](https://github.com/SourceHorizon/logger/compare/v2.5.0...v2.7.0) Updates `meta` from 1.16.0 to 1.18.0 - [Changelog](https://github.com/dart-lang/sdk/blob/main/CHANGELOG.md) - [Commits](https://github.com/dart-lang/sdk/commits/1.18.0/pkg) Updates `mobx` from 2.5.0 to 2.6.0 - [Release notes](https://github.com/mobxjs/mobx.dart/releases) - [Changelog](https://github.com/mobxjs/mobx.dart/blob/main/CHANGELOG.md) - [Commits](https://github.com/mobxjs/mobx.dart/compare/mobx-2.5.0...mobx-2.6.0) Updates `mobx_codegen` from 2.6.2 to 2.7.7 - [Release notes](https://github.com/mobxjs/mobx.dart/releases) - [Changelog](https://github.com/mobxjs/mobx.dart/blob/main/CHANGELOG.md) - [Commits](https://github.com/mobxjs/mobx.dart/compare/mobx_codegen-2.6.2...mobx_codegen-2.7.4) Updates `mockito` from 5.4.4 to 5.6.4 - [Release notes](https://github.com/dart-lang/build/releases) - [Commits](https://github.com/dart-lang/build/commits/mockito-v5.6.4/builder_pkgs) Updates `mocktail` from 1.0.4 to 1.0.5 - [Release notes](https://github.com/felangel/mocktail/releases) - [Commits](https://github.com/felangel/mocktail/compare/mocktail-v1.0.4...mocktail-v1.0.5) Updates `provider` from 6.1.5 to 6.1.5+1 - [Commits](https://github.com/rrousselGit/provider/compare/provider-v6.1.5...provider-v6.1.5) Updates `string_validator` from 1.1.0 to 1.2.0 - [Release notes](https://github.com/suragch/string_validator/releases) - [Changelog](https://github.com/suragch/string_validator/blob/master/CHANGELOG.md) - [Commits](https://github.com/suragch/string_validator/commits) Updates `syncfusion_flutter_charts` from 33.2.12 to 33.2.15 - [Release notes](https://github.com/syncfusion/flutter-widgets/releases) - [Commits](https://github.com/syncfusion/flutter-widgets/commits/HEAD/packages) Updates `test_api` from 0.7.6 to 0.7.11 - [Release notes](https://github.com/dart-lang/test/releases) - [Commits](https://github.com/dart-lang/test/commits/test_api-v0.7.11/pkgs) --- updated-dependencies: - dependency-name: build_runner dependency-version: 2.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: adapty_flutter dependency-version: 3.17.0 dependency-type: direct:production dependency-group: flutter-dependencies - dependency-name: test_api dependency-version: 0.7.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: flutter-dependencies - dependency-name: meta dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: mobx_codegen dependency-version: 2.7.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: mockito dependency-version: 5.6.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: dependency_validator dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-major dependency-group: flutter-dependencies - dependency-name: cached_network_image dependency-version: 3.4.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: flutter-dependencies - dependency-name: crypto dependency-version: 3.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: flutter-dependencies - dependency-name: cupertino_icons dependency-version: 1.0.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: flutter-dependencies - dependency-name: flex_color_scheme dependency-version: 8.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: flutter_chat_core dependency-version: 2.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: flutter_chat_ui dependency-version: 2.11.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: flutter_slidable dependency-version: 4.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: flutter-dependencies - dependency-name: http dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: logger dependency-version: 2.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: meta dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: mobx dependency-version: 2.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: mobx_codegen dependency-version: 2.7.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: mockito dependency-version: 5.6.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: mocktail dependency-version: 1.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: flutter-dependencies - dependency-name: provider dependency-version: 6.1.5+1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: flutter-dependencies - dependency-name: string_validator dependency-version: 1.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: syncfusion_flutter_charts dependency-version: 33.2.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: flutter-dependencies - dependency-name: test_api dependency-version: 0.7.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: flutter-dependencies ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (29 Jun 26)

  build(deps): bump anthropics/claude-code-action (#1154) Bumps the github-actions group with 1 update: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action). Updates `anthropics/claude-code-action` from 1.0.153 to 1.0.159 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/2fee15510437d71399d9139ed60433470484a8fb...a92e7c70a4da9793dc164451d829089dc057a464) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.159 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (29 Jun 26)

  build(deps): bump the appium-wdio-npm group (#1153) Bumps the appium-wdio-npm group in /automation/appium/wdio with 7 updates: | Package | From | To | | --- | --- | --- | | [@wdio/cli](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-cli) | `9.29.0` | `9.29.1` | | [@wdio/globals](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-globals) | `9.29.0` | `9.29.1` | | [@wdio/local-runner](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-local-runner) | `9.29.0` | `9.29.1` | | [@wdio/mocha-framework](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-mocha-framework) | `9.29.0` | `9.29.1` | | [@wdio/spec-reporter](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-spec-reporter) | `9.29.0` | `9.29.1` | | [webdriverio](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/webdriverio) | `9.29.0` | `9.29.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.0.0` | `26.0.1` | Updates `@wdio/cli` from 9.29.0 to 9.29.1 - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.29.1/packages/wdio-cli) Updates `@wdio/globals` from 9.29.0 to 9.29.1 - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.29.1/packages/wdio-globals) Updates `@wdio/local-runner` from 9.29.0 to 9.29.1 - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.29.1/packages/wdio-local-runner) Updates `@wdio/mocha-framework` from 9.29.0 to 9.29.1 - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.29.1/packages/wdio-mocha-framework) Updates `@wdio/spec-reporter` from 9.29.0 to 9.29.1 - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.29.1/packages/wdio-spec-reporter) Updates `webdriverio` from 9.29.0 to 9.29.1 - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.29.1/packages/webdriverio) Updates `@types/node` from 26.0.0 to 26.0.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@wdio/cli" dependency-version: 9.29.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: appium-wdio-npm - dependency-name: "@wdio/globals" dependency-version: 9.29.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: appium-wdio-npm - dependency-name: "@wdio/local-runner" dependency-version: 9.29.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: appium-wdio-npm - dependency-name: "@wdio/mocha-framework" dependency-version: 9.29.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: appium-wdio-npm - dependency-name: "@wdio/spec-reporter" dependency-version: 9.29.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: appium-wdio-npm - dependency-name: webdriverio dependency-version: 9.29.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: appium-wdio-npm - dependency-name: "@types/node" dependency-version: 26.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: appium-wdio-npm ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (29 Jun 26)

  build(deps): bump faraday from 1.10.5 to 1.10.6 in /ios (#1152) Bumps [faraday](https://github.com/lostisland/faraday) from 1.10.5 to 1.10.6. - [Release notes](https://github.com/lostisland/faraday/releases) - [Changelog](https://github.com/lostisland/faraday/blob/main/CHANGELOG.md) - [Commits](https://github.com/lostisland/faraday/compare/v1.10.5...v1.10.6) --- updated-dependencies: - dependency-name: faraday dependency-version: 1.10.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (29 Jun 26)

  build(deps-dev): bump @playwright/test (#1151) Bumps the safari-extension-npm group in /ios/BlockaWebExtension with 1 update: [@playwright/test](https://github.com/microsoft/playwright). Updates `@playwright/test` from 1.61.0 to 1.61.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](https://github.com/microsoft/playwright/compare/v1.61.0...v1.61.1) --- updated-dependencies: - dependency-name: "@playwright/test" dependency-version: 1.61.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: safari-extension-npm ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (29 Jun 26)

  build(deps): bump gradle-wrapper in /android in the android-gradle group (#1150) Bumps the android-gradle group in /android with 1 update: [gradle-wrapper](https://github.com/gradle/gradle). Updates `gradle-wrapper` from 9.6.0 to 9.6.1 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](https://github.com/gradle/gradle/compare/v9.6.0...v9.6.1) --- updated-dependencies: - dependency-name: gradle-wrapper dependency-version: 9.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: android-gradle ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• kar (26 Jun 26)

  fix(appium): tolerate empty iOS-26 nav-bar title in Settings descent The DNS onboarding flow navigates iOS Settings (General -> VPN & Device Management -> DNS) to install the Blokada DNS profile. On a profile-less device (e.g. the CI runner) this path runs for the first time and hit a latent bug: iOS 26 large-title screens (notably General) leave the nav-bar's own name/label empty, so getNavigationTitle() returned empty and openSettingsSection() wrongly concluded the tap failed, backed out, and ultimately threw "Failed to find General in Settings". Two fixes in settings.ts: - getNavigationTitle(): fall back to the nav-bar's StaticText child when its own name/label are empty, so the large title is still read. - openSettingsSection(): if the row we just tapped is gone, accept that we navigated regardless of title timing; a genuinely wrong destination is still caught by the next section's scroll-search. This was masked on dev devices that already had the DNS profile installed (onboarding skipped, Settings navigation never exercised). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

• kar (26 Jun 26)

  ci: add paywall golden screenshot for smoke tests

• kar (26 Jun 26)

  fix(appium): wake device before each spec session The wdio.conf `after` hook sleeps the device after every spec file (each spec runs as its own sequential worker), but `make appium-test` only wakes the device once before the whole run. With two specs, after the paywall spec locked the device, the dns-onboarding spec's WebDriverAgent session could not launch the app on the locked screen (retried 3x, "reason: Locked") and the run failed. Add a beforeSession hook that wakes the device (mirroring the Makefile's devicectl wake), keep the after-lock so the device still sleeps after the final spec, and guard the after-lock against a missing session (removes the secondary "browser.lock is not a function" noise). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

• kar (26 Jun 26)

  test(appium): add paywall golden baseline Captured on a real device (UPDATE_GOLDEN=1) — the Blokada Cloud Adapty paywall. Device-resolution specific; regenerate after any intentional paywall change. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

• kar (26 Jun 26)

  test(appium): add paywall smoke scenario + automated account control Add a second iOS smoke scenario that opens the Adapty paywall on an inactive account, screenshots it, and strict-compares to a committed golden. Because the paywall needs an inactive (libre) account — the opposite of the DNS onboarding scenario's active account — add an automated way to switch account state before each scenario instead of relying on a manually-pinned account. - account.ts: switch account via the existing command bus through the support chat (`cc restore <id>`), reading ids from BLOKADA_ACTIVE_/ INACTIVE_ACCOUNT_ID. ensureAccountActive/Inactive let each spec self-provision its state; restoreAccount waits for a history-proof completion signal before relaunching. - paywall.spec.ts: restore inactive, tap power, assert the native paywall presents (negative guards for pause sheet / DNS sheet / protection-on), screenshot, strict golden compare. - golden.ts: pixelmatch+pngjs comparison with status-bar masking, UPDATE_GOLDEN regen, and diff/actual artifacts on mismatch. - wdio.conf.ts: explicit ordered specs (paywall first -> suite ends with the device active). dns-onboarding self-heals via ensureAccountActive. - appium-smoke.yml: pass the two account secrets to the run step. The power toggle reflects protection on/off, not account state, so account state is verified behaviorally (paywall vs protection/DNS). Operator must provision the two dev-account secrets and capture the initial golden on the test device (UPDATE_GOLDEN=1). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

• kar (25 Jun 26)

  build(deps): pin pigeon to 12.0.1 via dependency_overrides (hold pigeon 26) pigeon 26 needs a native Swift/Kotlin codegen migration and is deliberately held. The dependabot semver-major ignore and the flutter-dependencies group `exclude-patterns: [pigeon]` do not hold: grouping other bumps lets Dependabot's solver re-widen `pigeon: ^12.0.0` to `>=12.0.0 <27.0.0` and re-lock 26.3.2 (most recently #1139), which breaks `make gen-*` codegen (CommandEvents.setup -> setUp). A dependency_override can't be widened by Dependabot, so it pins the lock. Lock is unchanged (already at 12.0.1); this just makes the pin durable. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

• dependabot[bot] (22 Jun 26)

  build(deps): bump the android-gradle group in /android with 6 updates Bumps the android-gradle group in /android with 6 updates: | Package | From | To | | --- | --- | --- | | androidx.lifecycle:lifecycle-livedata-ktx | `2.10.0` | `2.11.0` | | androidx.lifecycle:lifecycle-viewmodel-ktx | `2.10.0` | `2.11.0` | | androidx.lifecycle:lifecycle-runtime-ktx | `2.10.0` | `2.11.0` | | androidx.compose:compose-bom | `2026.05.01` | `2026.06.00` | | com.google.firebase:firebase-bom | `34.14.1` | `34.15.0` | | [gradle-wrapper](https://github.com/gradle/gradle) | `9.5.1` | `9.6.0` | Updates `androidx.lifecycle:lifecycle-livedata-ktx` from 2.10.0 to 2.11.0 Updates `androidx.lifecycle:lifecycle-viewmodel-ktx` from 2.10.0 to 2.11.0 Updates `androidx.lifecycle:lifecycle-runtime-ktx` from 2.10.0 to 2.11.0 Updates `androidx.compose:compose-bom` from 2026.05.01 to 2026.06.00 Updates `com.google.firebase:firebase-bom` from 34.14.1 to 34.15.0 Updates `gradle-wrapper` from 9.5.1 to 9.6.0 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](https://github.com/gradle/gradle/compare/v9.5.1...v9.6.0) --- updated-dependencies: - dependency-name: androidx.lifecycle:lifecycle-livedata-ktx dependency-version: 2.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: android-gradle - dependency-name: androidx.lifecycle:lifecycle-viewmodel-ktx dependency-version: 2.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: android-gradle - dependency-name: androidx.lifecycle:lifecycle-runtime-ktx dependency-version: 2.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: android-gradle - dependency-name: androidx.compose:compose-bom dependency-version: 2026.06.00 dependency-type: direct:production dependency-group: android-gradle - dependency-name: com.google.firebase:firebase-bom dependency-version: 34.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: android-gradle - dependency-name: gradle-wrapper dependency-version: 9.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: android-gradle ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot] (22 Jun 26)

  build(deps): bump actions/checkout from 6 to 7 Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot] (22 Jun 26)

  build(deps-dev): bump @types/node in /automation/appium/wdio Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.9.3 to 26.0.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot] (22 Jun 26)

  build(deps): bump anthropics/claude-code-action (#1143) Bumps the github-actions group with 1 update: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action). Updates `anthropics/claude-code-action` from 1.0.149 to 1.0.153 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/4d7e1f0cd85743fdc93b1c8040ab54395da024e2...2fee15510437d71399d9139ed60433470484a8fb) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.153 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (22 Jun 26)

  build(deps): bump the appium-wdio-npm group (#1141) Bumps the appium-wdio-npm group in /automation/appium/wdio with 5 updates: | Package | From | To | | --- | --- | --- | | [@wdio/cli](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-cli) | `9.28.0` | `9.29.0` | | [@wdio/globals](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-globals) | `9.28.0` | `9.29.0` | | [@wdio/local-runner](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-local-runner) | `9.28.0` | `9.29.0` | | [@wdio/spec-reporter](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-spec-reporter) | `9.28.0` | `9.29.0` | | [webdriverio](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/webdriverio) | `9.28.0` | `9.29.0` | Updates `@wdio/cli` from 9.28.0 to 9.29.0 - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.29.0/packages/wdio-cli) Updates `@wdio/globals` from 9.28.0 to 9.29.0 - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.29.0/packages/wdio-globals) Updates `@wdio/local-runner` from 9.28.0 to 9.29.0 - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.29.0/packages/wdio-local-runner) Updates `@wdio/spec-reporter` from 9.28.0 to 9.29.0 - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.29.0/packages/wdio-spec-reporter) Updates `webdriverio` from 9.28.0 to 9.29.0 - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.29.0/packages/webdriverio) --- updated-dependencies: - dependency-name: "@wdio/cli" dependency-version: 9.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: appium-wdio-npm - dependency-name: "@wdio/globals" dependency-version: 9.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: appium-wdio-npm - dependency-name: "@wdio/local-runner" dependency-version: 9.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: appium-wdio-npm - dependency-name: "@wdio/spec-reporter" dependency-version: 9.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: appium-wdio-npm - dependency-name: webdriverio dependency-version: 9.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: appium-wdio-npm ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Karol Gusak (19 Jun 26)

  fix(ios): gate ITMS-91065 on signed=true, warn (not fail) on missing timestamp (#1138) The 26.2.21 release build hit the verify gate, not Apple: the bundle-signing from #1137 worked — every plugin xcframework's recorded origin signature is now `signed=true` (was `signed=false` in 26.2.20) — but `isSecureTimestamp=false`, and the gate required both, so it failed the build before upload. `signed=true` is the documented ITMS-91065 requirement ("the SDK must include a signature file"). A secure timestamp is best-practice (Apple's example signs with --timestamp) but is NOT confirmed to be required, and Xcode's archive does not reliably stamp `isSecureTimestamp=true` onto the recorded origin signature even when the .xcframework was signed with --timestamp. Requiring it blocks a build that already meets the documented requirement. Gate hard on `signed=true`; downgrade a missing secure timestamp to a WARNING so the build uploads and App Store Connect — the only authority on whether the timestamp is mandatory — gives the verdict. If Apple still flags ITMS-91065, we'll know the timestamp is required and can target it specifically. Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• Karol Gusak (19 Jun 26)

  fix(ios): sign plugin xcframework bundles w/ timestamp (real ITMS-91065 fix) (#1137) ITMS-91065 ("Missing signature") kept rejecting sqflite_darwin across 26.2.18– 26.2.20 despite the embedded framework being validly code-signed. Root cause, found by inspecting the rejected IPA: ITMS-91065 does NOT read the embedded framework's code signature — it reads the xcframework's *origin* signature, recorded by the archive into `Signatures/<name>.xcframework-ios.signature`. For every plugin that file said `signed=false, isSecureTimestamp=false`, because we signed the inner .framework while the .xcframework *bundle* stayed unsigned (and the host export re-signs the embedded slice anyway, so the inner signing was a no-op — it never affected the shipped binary). Fix = Apple's canonical command, also the sqflite maintainer's accepted fix (tekartik/sqflite#1129): sign the .xcframework BUNDLE with `--timestamp`, so the recorded origin signature is signed=true AND isSecureTimestamp=true. - sign-ios-frameworks.sh: sign the plugin .xcframework bundles with `--timestamp` (was: inner per-slice .framework, no timestamp). Keep excluding Flutter (already Google-signed; re-signing broke the archive in 26.2.18), App and FlutterPluginRegistrant (not third-party SDKs). Verify each carries a secure timestamp before the archive consumes it. - verify-ios-ipa-signatures.sh: add the real ITMS-91065 gate — parse Signatures/*.xcframework-ios.signature and require signed=true + isSecureTimestamp=true for each non-excluded SDK xcframework. Keep the embedded code-signature check as a defensive secondary check. Verified against the actual rejected 26.2.20 IPA: the new gate FAILS it on all 9 plugin origin signatures (signed=false) and PASSES once corrected. Confirmed locally that `codesign --timestamp --sign` on an .xcframework yields a secure Timestamp. Supersedes the inner-framework signing from #1135 (#1136 unaffected). Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• Karol Gusak (19 Jun 26)

  fix(ios): make IPA signature verifier SIGPIPE-safe (fixes make Error 141) (#1136) verify-ios-ipa-signatures.sh died with exit 141 on the real release archive: `make[1]: *** [build-ios-six] Error 141`. The archive itself now succeeds (Flutter/App exclusion works — `sign-ios-frameworks: signed & verified 18 framework(s)`), but the verifier piped `codesign -dvv | awk '…exit'`. awk's early exit closes the pipe, codesign dies with SIGPIPE, and `set -o pipefail` + `set -e` propagate 141 and abort the script. Local test frameworks were too small to keep codesign writing past awk's exit, so it only triggered on the large real frameworks in CI. Parse captured strings via here-strings / bash builtins instead of piping into early-exiting consumers (awk exit, grep -q, head): capture `codesign -dvv` into a var first, match the authority with `case`, take the first verify line with `${verr%%$'\n'*}`, and feed the required-framework grep from a here-string. Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• Karol Gusak (19 Jun 26)

  fix(appium): resolve Dependabot alerts in wdio test tooling (#1134) All three open Dependabot alerts live in the Appium/WDIO end-to-end test tooling (automation/appium/wdio) as transitive npm deps — none ship in the app. Local `npm audit` also flagged two undici highs Dependabot hadn't yet surfaced. Fixes: - form-data 4.0.5 -> 4.0.6 (high, GHSA-hmw2-7cc7-3qxx; carried via axios 1.18.0) - undici 7.27.1 -> 7.28.0 (high x2, TLS bypass + cache disclosure) - serialize-javascript 6.0.2 -> 7.0.6 via overrides (high GHSA-5c6j-r48x-rmvq + medium GHSA-qj8w-gfj5-8c6v). mocha still pins ^6, and `audit fix --force` would downgrade @wdio/mocha-framework to 7.7.3 — so pin via npm overrides instead. Remaining bumps (@wdio/mocha-framework 9.29.0, appium 3.5.2) are in-range semver from `npm audit fix`; no downgrades. mocha stays 10.8.2. Validation: `npm audit` -> 0 vulnerabilities; 87/87 unit tests pass; mocha --parallel run (the serialize-javascript worker-IPC path) passes, confirming the v7 override is compatible. Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>