Blokada

Recent Commits

• Karol Gusak (28 Jul 26)

  feat(release): continuous delivery pipeline rework (#1196) * feat(release): publish Android to closed and open testing too Releases only reached the internal track, so closed (alpha) and open (beta) testing were promoted by hand. Both require review, unlike internal, so the manual step was also the review submission. Upload the AAB to internal once as before, then attach that same version code to each promote track. A version code can only be *uploaded* once, so the extra tracks have to reference it rather than re-upload it -- running supply three times with --aab would fail on runs 2 and 3. Hence --track_promote_to with --skip_upload_aab. Despite the name, promoting does not move the build off the source track: supply's promote_track reads the release from the source and writes only the target (supply/lib/supply/uploader.rb), so the build ends up on internal, alpha and beta. The promote runs skip all metadata/changelog/image/screenshot uploads. Two reasons: store-listing changes are app-level review items and re-sending them per track is wasteful, and metadata_path defaults to `(Dir["./fastlane/metadata/android"] + Dir["./metadata"]).first` -- this repo has ./metadata, whose children are android-six/ios-family/etc, so supply would otherwise treat those directory names as locale codes. Release notes still reach the new tracks because promotion copies the whole release object. They also set --rescue_changes_not_sent_for_review false. That option defaults to TRUE, and on a "Please set the query parameter changesNotSentForReview to true" refusal it silently re-commits with changes_not_sent_for_review: true and exits 0 -- a green run with the build sitting unsubmitted, needing a manual click in the console. For a step whose entire purpose is submitting for review, that failure has to be loud. publish_android now passes BLOKADA_VERSION_CODE, the same value build_android baked into the AAB via `make version`. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * docs: design for the continuous-delivery release pipeline Specifies the reworked pipeline: every merge to main builds all four artifacts and uploads to Play internal + TestFlight, and releasing becomes a promote-only step that never builds, so the shipped binary is the exact one that sat on internal. Covers the YY.M.BUILD version scheme, the git-tag build-number allocator, both workflows, the make/lane restructure, and the sequencing. Records the platform behaviour the design depends on, verified against the installed fastlane 2.232.0 rather than docs: promote does not remove the build from the source track; rescue_changes_not_sent_for_review defaults true and silently swallows failed review submissions; metadata_path defaults to ./metadata which this repo has, with non-locale children; workflow_dispatch requires the workflow on the default branch but push does not. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * refactor(release): single-source the version code offset, split Play targets The offset lived inside version.py, so nothing else could compute the store code -- and the promote loop passed the raw build number to --version_code, which never matches the artifact (the AAB carries 669000000 + that). Move the offset to the Makefile so stamping and promotion share one definition. Split the Play paths: publish-android is the per-merge internal upload with no store listing, promote-android is the release-time promotion to alpha/beta that also attaches release notes. * feat(release): git-tag build number allocator Forever-incrementing counter stored as annotated build/N tags, immune to the two flaws that make GITHUB_RUN_NUMBER unusable: it does not repeat on re-run, and it cannot reset when a workflow file is renamed. The tag annotation carries the version name because the name is baked into the binary at build time -- a build allocated in July stays 26.7.N even when promoted in August, so the release step must read it back rather than recompute it. * fix(release): surface real git errors, cover the retry/lock path in tests allocate's push failure and resolve's fetch failure both discarded git's actual stderr, so a real infrastructure failure (bad credentials, network down, a protected tag) was indistinguishable from a normal lost race -- an operator debugging an unattended release run got only a generic message. Capture the output on both paths and surface it once the retry budget is exhausted / the tag still can't be read, while keeping the per-attempt retry itself quiet. Also add deterministic test coverage for the retry/lock path: a pre-receive hook on the test's throwaway remote simulates a single lost race (exercises the delete-local-tag/re-read/backoff branch) and a permanent rejection (exercises the final-failure branch and proves the real git error now reaches stderr). Previously every allocate in the test suite won its push on the first attempt, so that code was never exercised. Also force resolve's fetch refspec (+refs/tags/...) so a diverged local tag on a persistent checkout can't be silently preferred over the remote's. * fix(release): capture ls-remote errors without losing them across a subshell, redact credentials everywhere highest()'s git ls-remote call still discarded its real stderr via two "|| true" call sites. resolve latest was the concretely bad path: an unreachable remote (bad network, auth, protected refs) was reported as "no build/* tags on $REMOTE" -- indistinguishable from a genuinely empty, reachable remote, with no diagnostic text to act on. First attempt at the fix set a global variable inside highest() and read it back at the call sites; that is broken, since both call sites invoke highest() via $(...), which forks a subshell, and a variable assignment made inside a subshell never survives past it. Caught with `bash -x` before committing. Fixed by using the one channel that does survive the subshell boundary: highest()'s own captured stdout now doubles as the error channel on failure (empty stdout = genuinely no tags; non-empty, non-numeric stdout = the redacted ls-remote error), so callers can tell the two failure modes apart with a single string check. Also redact credentials from every captured diagnostic (push, fetch, ls-remote, and $REMOTE itself when echoed) instead of the narrower "strip //user:pass@" pattern originally suggested: git's https:// transport already sanitizes its own error text, but a malformed git:// URL does not -- it echoes the raw "user:pass@host" verbatim with no "://" anywhere near it. The broader pattern catches both shapes. * feat(release): TestFlight-only upload lanes for the continuous path deliver creates an App Store version record per run, so using it on every merge would generate hundreds of junk versions and fail outright while a release sits in Pending Developer Release. upload_to_testflight needs no version record. * feat(release): promote-ios attaches an existing build to a version Renames publish-ios to promote-ios, matching promote-android: it never builds or uploads a binary, it points an App Store version at a build already on TestFlight, so the shipped binary is the tested one. app_version comes from the caller because deliver looks a build up by (app_version, build_number), and the name was baked in at build time. Review submission is opt-in and approved builds stop at Pending Developer Release. * chore(ci): remove OneDev manual publish jobs superseded by promote path The new promote-only release path (make promote-android / promote-ios) supersedes OneDev's "publish android manually" and "publish ios manually" jobs. Leaving them meant one broken job and one silently wrong one: - "publish ios manually" ran `make publish-ios`, a target that no longer exists after this branch's rename to `promote-ios`, so it would fail outright with "No rule to make target". Even renamed it could not work: it only passes a flavor param, with nothing wired to BLOKADA_VERSION_CODE / BLOKADA_VERSION_NAME, which promote-ios now requires. - "publish android manually" still ran `make publish-android`, which this branch's Task 1 repurposed to internal-only with no promote step and no metadata. It would keep reporting success while silently no longer reaching alpha/beta. OneDev already lost tag-based releasing in e99de069; these jobs are replaced by the GitHub Actions release.yml workflow. All other OneDev jobs (run tests, build android, build all android, build ios, fastlane match, pull github) are untouched. * feat(release): build and ship every merge to internal channels Allocates a build number, builds six and family for both platforms, and uploads to Play internal and TestFlight. Nothing is published and nothing is submitted for review. Carries a temporary branch trigger so the flow can be exercised before merge; removed in the final commit. * feat(release): promote-only release workflow Dispatch-only, and never builds: it promotes a build number that ci-release.yml already uploaded, to Play alpha/beta and an App Store version. iOS review submission is opt-in and defaults to off; approved builds stop at Pending Developer Release. Dispatch-only because the version name now contains the build number, so it is an output of the build and cannot be declared by a tag up front. * fix(release): route dispatch inputs through env vars, not shell interpolation release.yml interpolated \${{ inputs.build_number }}, \${{ inputs.flavor }}, \${{ inputs.platform }} and \${{ inputs.submit_ios_for_review }} directly into run: script bodies. GitHub substitutes those expressions into the script text before the shell parses it, and choice-typed inputs are not enforced when dispatched via the API, so a crafted value would run arbitrary shell on the self-hosted build-only runner. Bind each input to an env var on the step and reference it as a quoted shell variable instead, matching the pattern release-tag.yml already used (INPUT_VERSION_NAME / INPUT_FLAVOR / INPUT_PLATFORM). No behavior change: same flavors JSON, same GITHUB_OUTPUT lines, same summary text. * chore(release): retire the tag-triggered release workflow Replaced by ci-release.yml (build on merge) and release.yml (promote on dispatch). A tag can no longer declare a version, because the version now contains the build number and is only known after allocation -- leaving the trigger would let a pushed tag name a version the binary never has. The 429 existing tags stay as history; they all contain a slash, so they never collide with the new build/N and YY.M.N tags. * chore(release): move translation coverage reporting to ci-release.yml The translation_coverage job's only caller was the now-deleted release-tag.yml, which would have left it orphaned. Port it into ci-release.yml as-is (ubuntu-latest, 10m timeout, continue-on-error on both steps, shallow deps/translate-only submodule init) so coverage now reports on every merge to main instead of only at release time -- lag surfaces days earlier and is fixable before release day. The job carries no needs on allocate and nothing depends on it, so it runs independently in parallel with the build jobs and can never gate them. continue-on-error stays load-bearing: a red ci-release run now means main is not publishable, so translation lag must never trigger that signal. Also updates the script's docstring, which pointed at release-tag.yml by name. * fix(release): scope ci-release.yml job permissions to least privilege translation_coverage inherited the workflow-level contents: write meant for allocate's build/N tag push, even though it only checks out, inits one submodule, and writes to the step summary -- a privilege-scope regression introduced when the job moved here from release-tag.yml, which ran it under contents: read. Add job-level contents: read to translation_coverage, android, and ios (none of the three push to the repo; android/ios upload to the stores with their own secrets, not the GitHub token). A previous review had already flagged the workflow-level grant as over-broad for android/ios; closing it here alongside the translation_coverage fix. allocate keeps contents: write, now stated explicitly at job level rather than relying on inheritance. The workflow-level permissions: block is left in place since allocate still needs it. Also rewraps translation_coverage.py's docstring, which split "primary language" awkwardly across lines after the earlier edit -- cosmetic only. * chore(release): drop the temporary branch trigger The flow has been exercised from the branch; ci-release.yml now fires on main only. * fix(release): validate the resolve target before it reaches git `resolve` accepted any string and interpolated it straight into a `git fetch` refspec and a `git tag -l` pattern. `build_number: "*"` in a workflow_dispatch therefore matched every build tag and printed one `version_name=` line per tag into $GITHUB_OUTPUT, which GitHub reads as an arbitrary set of step outputs. Reject anything that is not `latest` or a plain non-negative integer, with a message naming the rejected value. Covered by a new case in scripts/test-build-number.sh, which fails against the pre-fix script. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_011C1cyKCDJhZBLxFFXLL9fb * fix(release): release to alpha/beta directly instead of promoting from internal Only the newest build on internal was promotable, so the normal soak-then-release case could not ship at all. `--track internal --track_promote_to <t>` makes supply read the internal track's release list (uploader.rb#promote_track) and filter it by version code. But every continuous upload calls update_track, which assigns `track.releases = [track_release]` (uploader.rb:422-431), and Play drops releases omitted from edits.tracks.update. One merge later build N is gone from internal and promotion dies with "Track 'internal' doesn't have any releases". At 2-3 merges per working day that is the default path, not an edge case. The AAB is still in Play's bundle explorer, but the pipeline had no way to reach it. Write the target track directly instead, which needs no source-track membership. With --skip_upload_aab/--skip_upload_apk and --version_codes_to_retain N, perform_upload builds apk_version_codes = [N] from version_codes_to_retain alone, takes the non-empty branch into update_track on the target track, and still runs perform_upload_meta([N], <target>), so changelogs attach exactly as before. Add scripts/verify-play-version-code.py as a preflight: it lists the package's uploaded bundles and apks over the Play API and fails naming the code and pointing at ci-release, rather than letting supply surface a generic track error for a code that was never uploaded. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_011C1cyKCDJhZBLxFFXLL9fb * fix(release): attach the build to the App Store version on the default path deliver calls submit_for_review only when options[:submit_for_review] is set (deliver/lib/deliver/runner.rb:71), and options[:build_number] is consumed nowhere else in deliver -- only inside deliver/lib/deliver/submit_for_review.rb#select_build. With submit_for_review off, which is the deliberate default, promote-ios created the App Store version and uploaded metadata but never attached the binary, while the job name, the Makefile comment and the Fastfile comment all said it did. Attach the build explicitly after deliver, following the same Spaceship::ConnectAPI shape select_build uses: find the app by bundle id, take the editable App Store version for iOS, look the build up by app_version + build_number, select it. Re-selecting an already-selected build is the same PATCH with the same value, so re-runs are safe. A build that is not VALID yet fails with a message saying it is still processing, rather than continuing silently. Skipped when submit_for_review is on, since deliver's own submit flow selects the build and then moves the version out of an editable state. Also fix the submit flag itself: fastlane's CommandLineHandler.convert_value turns `submit_for_review:true` into the Ruby boolean true, so the existing `options[:submit_for_review] == "true"` never matched and submitting for review could not be turned on at all. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_011C1cyKCDJhZBLxFFXLL9fb * fix(release): tag the built commit, share one concurrency group, narrow permissions Three workflow fixes. The record tag pointed at the wrong commit. The tag job checked out github.sha -- main HEAD at dispatch time -- and tagged that, but the build being released may have been cut days and many merges earlier, so 26.7.N silently named a commit that never shipped. Fetch build/$N with --depth 1 onto the shallow checkout and tag build/$N^{} instead, keeping the run URL in the annotation. Verified on a genuinely shallow clone: the targeted tag fetch resolves the build commit 5 merges behind HEAD and the tag pushes. ci-release.yml and release.yml used separate concurrency groups, so a merge landing during a release ran publish-android against org.blokada.sex while promote_android held an open Play edit on the same package -- Play invalidates an edit whose underlying app state changed, so one side would fail confusingly. Both now use `store-publish` with cancel-in-progress: false, so a merge queues behind a release. release.yml's jobs inherited top-level `contents: write`. Only the tag job pushes, so the other three get `contents: read`, matching the narrowing ci-release.yml already had. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_011C1cyKCDJhZBLxFFXLL9fb * test(release): run the build-number and version tests in PR CI scripts/test-build-number.sh and scripts/test-version.sh were referenced by nothing -- not make, not ci.yml, not the OneDev spec -- yet they are the only automated coverage of two invariants that cannot be recovered from once broken: store codes only ever go up, and the offset is applied exactly once. Add `make test-scripts` running both, and a release_scripts job in ci.yml. They need only bash, git and python3, so the job runs on ubuntu-latest rather than taking a slot on the self-hosted macOS pool. Verified that a failing script fails the target (make exits 2 on a script exiting 3). Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_011C1cyKCDJhZBLxFFXLL9fb * chore(ci): remove OneDev build jobs that stamp unshippable version codes `build android`, `build all android` and `build ios` all passed BLOKADA_VERSION_CODE: '@build_number@' -- a OneDev counter far below the new 669001000 store-code floor -- so every artifact they produce carries an obsolete code. Their publish counterparts went in 10adf44c, so nothing can ship what they build. Leaves the file at the three jobs that still do useful work: run tests, fastlane match, pull github. No jobDependencies referenced the removed jobs (the two that did were removed with the publish jobs), and the file still parses as YAML. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_011C1cyKCDJhZBLxFFXLL9fb * docs(release): correct the Android constraint and close the runbook gaps Doc-only, matching the fixes on this branch. - Android promotion: replace the "track_promote_to keeps the build on the source track" claim with what actually constrains us -- update_track replaces a track's release list, so internal only ever holds the newest build and the release step writes the target track directly. The 90-day expiry note is now marked iOS-only, with the real Android constraint stated next to it. - iOS: document that deliver attaches a build only when submitting for review, and that each lane attaches it explicitly. - build/* tags are the allocator's only persistent state: drop "the tags are noise and can be pruned", state that the highest tag must never be deleted and that pruning requires raising the --start floor in the same commit. - Add a "Reaching production" section: the pipeline stops at alpha/beta and Pending Developer Release, and production is a console action on both stores. - Note that `build_number: latest` resolves the newest tag, which is allocated before the build runs, so the operator must confirm the corresponding ci-release run was green. - Qualify "a re-run allocates a fresh number": true for "Re-run all jobs", false for "Re-run failed jobs", which reuses the cached allocate output. - Record the shared `store-publish` concurrency group and its consequence. - Rewrite "Testing before merge" as a record of how the pipeline was validated (branch-scoped push trigger, green run, build/1000 = 26.7.1000, all four artifacts uploaded, trigger removed in 958d8f98) so it no longer reads as a pending action, and drop the matching known risk. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_011C1cyKCDJhZBLxFFXLL9fb * fix(release): read the App Store key from ios/, not ios/fastlane/ attach_build is lane-body code, not an action. Runner#execute wraps the whole lane in Dir.chdir(FastlaneFolder.path) (runner.rb:45), which is "./fastlane/" (fastlane_folder.rb:8-16), and try_switch_to_lane (runner.rb:185) does not chdir back. Only actions get moved up, by execute_action's `custom_dir ||= ".."` (runner.rb:218-229). make promote-ios runs fastlane from ios/, so deliver runs with cwd ios/ while attach_build's body runs with cwd ios/fastlane/. The key that `make appstore-key-unpack` writes is ios/blokada-appstore.json, so "./blokada-appstore.json" raised Errno::ENOENT in the lane body -- after deliver had already created the App Store version and uploaded metadata, leaving a version with no binary attached, which is exactly the state attach_build exists to prevent. Only the two attach_build call sites change. The api_key_path values handed to deliver and upload_to_testflight stay "./..." because those are actions, and metadata_path: "../metadata/ios-six/" corroborates it -- it only resolves to the repo-root metadata/ from ios/. Not fixed by dropping the token line: deliver does set Spaceship::ConnectAPI.token globally and never restores it (deliver/lib/deliver/runner.rb:30-32), but that is an implicit cross-action dependency and must not be depended on. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_011C1cyKCDJhZBLxFFXLL9fb * refactor(release): run the Play preflight on fastlane's own supply client The Python script hand-rolled service-account OAuth with a JWT signed by the openssl CLI, justified by "supply exposes no read-only entry point for the list of uploaded bundles". That is wrong: Supply::Client#aab_version_codes and #apks_version_codes (supply/lib/supply/client.rb:268-283) are exactly that read, and Supply::Client.make_from_config (client.rb:16-20) does the service-account auth. The real constraint -- the check must finish before supply opens the edit it will commit -- only needs a separate edit, which Supply::Client opens happily. The replacement opens a throwaway edit, lists bundle and APK version codes, and deletes the edit again. Construction matches supply's own: a real FastlaneCore::Configuration over Supply::Options.available_options rather than a bare hash, so the client gets supply's :timeout default and the :json_key verify_block that checks the file exists and is JSON before any network call. Fails closed. Argument errors, a missing or malformed key, auth failure, network failure and any unexpected response all exit non-zero; only a version code found among the uploaded artifacts exits 0. A failure to delete the throwaway edit warns but does not mask the check's own result. The promote-android recipe is otherwise unchanged: the --track <target> --version_codes_to_retain mechanism stays exactly as it was. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_011C1cyKCDJhZBLxFFXLL9fb * docs(release): correct what the shared concurrency group actually does The doc claimed a merge landing during a release "waits for the whole release to finish before it starts building" and that "nothing is ever cancelled". cancel-in-progress: false protects the running job, not the queue: GitHub keeps at most one pending run per concurrency group, so a second merge landing while a release holds store-publish cancels the first merge's pending run outright, and that commit is never built or uploaded. Say so, and say what it costs -- it partially undercuts the "no path filters, every commit on main is proven publishable" decision, and it breaks bisecting a release window to a single commit. Also point the Android preflight paragraph at the Ruby replacement and record how it authenticates. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_011C1cyKCDJhZBLxFFXLL9fb * ci: retire OneDev, delete the buildspec OneDev is no longer used. This branch already removed its publish jobs (they called Make targets this migration renamed or repurposed) and its build jobs (they stamped store codes below the new 669001000 floor and so produced unshippable artifacts), leaving three jobs. All three are superseded by GitHub Actions or are no longer wanted: - "run tests" (make ci-test) -> ci.yml runs the test suite on every PR. - "pull github" mirrored github.com/blokadaorg/blokada into OneDev on a weekday cron; with OneDev gone there is nothing to mirror into. - "fastlane match" was the only automated entry point for certificate and profile rotation. It is not replaced: match stays a local operation, as AGENTS.md already documents it under Mac Support. No other OneDev artifacts exist -- `git grep -in onedev` now matches only `isIPhoneDevice` in automation/shared/lib/devices.mjs, and nothing in .github/, docs/, AGENTS.md, BUILDING.md, CONTRIBUTING.md or README.md ever referenced OneDev or the buildspec by name. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_011C1cyKCDJhZBLxFFXLL9fb * fix(release): name the failing stage, correct two misleading docs The preflight's LoadError hint pointed at the fastlane install `make promote-android` uses. That is the Homebrew wrapper with a private GEM_HOME; the script runs under `ruby` from PATH and needs the gem there, so the hint misdirected exactly the operator it was written for. Its outer rescue also wrapped auth, edit-open and listing together, so an invalid_grant was reported as "could not list uploaded artifacts". Split into three stages, each naming itself. The edit cleanup still runs when the listing fails, since ensure runs before SystemExit propagates. The concurrency note described only a merge's queued run being evicted. A pending release run is evicted the same way when a merge lands after the dispatch -- the direction people actually notice, because the release vanishes from the queue rather than failing. Also drop `ci-test`: the OneDev buildspec was its only caller and it went with the buildspec. * chore(build): drop ci-copy-source and its CI_BUILD_DIR Orphaned before this branch -- nothing has invoked it, and CI_BUILD_DIR existed only to feed it. Removed alongside ci-test now that the OneDev buildspec that once used these is gone. --------- Co-authored-by: Claude Opus 5 (1M context) <[email protected]>

• Karol Gusak (28 Jul 26)

  fix(android): target Android 16 (API 36), migrate back handling (#1193) Google Play now requires targeting API 36. The bump alone would break back navigation: at targetSdk 36 enableOnBackInvokedCallback defaults to true and the deprecated Activity.onBackPressed() override is no longer invoked, so back would background the app instead of navigating. Replaced the override with an always-enabled OnBackPressedCallback on the OnBackPressedDispatcher, same logic, works on all API levels. Checked the other target-36 gated changes: edge-to-edge opt-out unused (app already draws edge-to-edge), 64-bit wireguard .so files are 16 KB aligned, and the portrait lock being ignored on >=600dp screens is left as-is pending the adaptive layout work. Co-authored-by: Claude Fable 5 <[email protected]>

• Karol Gusak (27 Jul 26)

  test(appium): stabilize Activity Show All tap (settle, coordinate tap, retry) (#1194) The spec's element.click() on Show All is ACKed by WDA (HTTP 200) but intermittently swallowed before Flutter's gesture arena while the just- scrolled list settles — device log shows onTap never fires (no onNavigated/setRoute, no exceptions) while the app sits on Privacy Pulse; ~60% of runs since Jul 25. Replace with a settle-wait (position stationary across 300ms probes) plus mobile:tap at the element center, and one retry guarded by Show All still being on screen. Co-authored-by: Claude Fable 5 <[email protected]>

• dependabot[bot] (27 Jul 26)

  build(deps): bump anthropics/claude-code-action (#1192) Bumps the github-actions group with 1 update: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action). Updates `anthropics/claude-code-action` from 1.0.178 to 1.0.183 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/af0559ee4f514d1ef21826982bed13f7edc3c35e...be7b93b1907a4abad570368f3c74b6fe3807510b) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.183 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (27 Jul 26)

  build(deps): bump the appium-wdio-npm group (#1191) Bumps the appium-wdio-npm group in /automation/appium/wdio with 4 updates: [@wdio/cli](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-cli), [@wdio/local-runner](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-local-runner), [@wdio/mocha-framework](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-mocha-framework) and [webdriverio](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/webdriverio). Updates `@wdio/cli` from 9.29.1 to 9.30.0 - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.30.0/packages/wdio-cli) Updates `@wdio/local-runner` from 9.29.1 to 9.30.0 - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.30.0/packages/wdio-local-runner) Updates `@wdio/mocha-framework` from 9.29.1 to 9.30.0 - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.30.0/packages/wdio-mocha-framework) Updates `webdriverio` from 9.29.1 to 9.30.0 - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.30.0/packages/webdriverio) --- updated-dependencies: - dependency-name: "@wdio/cli" dependency-version: 9.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: appium-wdio-npm - dependency-name: "@wdio/local-runner" dependency-version: 9.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: appium-wdio-npm - dependency-name: "@wdio/mocha-framework" dependency-version: 9.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: appium-wdio-npm - dependency-name: webdriverio dependency-version: 9.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: appium-wdio-npm ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (27 Jul 26)

  build(deps): bump net.danlew:android.joda in /android (#1190) Bumps [net.danlew:android.joda](https://github.com/dlew/joda-time-android) from 2.14.2 to 2.14.2.1. - [Release notes](https://github.com/dlew/joda-time-android/releases) - [Changelog](https://github.com/dlew/joda-time-android/blob/main/CHANGELOG.md) - [Commits](https://github.com/dlew/joda-time-android/compare/v2.14.2...v2.14.2.1) --- updated-dependencies: - dependency-name: net.danlew:android.joda dependency-version: 2.14.2.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (27 Jul 26)

  build(deps): bump com.android.tools.build:gradle (#1189) Bumps the android-gradle group in /android with 1 update: com.android.tools.build:gradle. Updates `com.android.tools.build:gradle` from 9.3.0 to 9.3.1 --- updated-dependencies: - dependency-name: com.android.tools.build:gradle dependency-version: 9.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: android-gradle ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (27 Jul 26)

  build(deps): bump the flutter-dependencies group (#1188) Bumps the flutter-dependencies group in /common with 4 updates: [build_runner](https://github.com/dart-lang/build), [mobx_codegen](https://github.com/mobxjs/mobx.dart), [mockito](https://github.com/dart-lang/build/tree/master/builder_pkgs) and [syncfusion_flutter_charts](https://github.com/syncfusion/flutter-widgets/tree/master/packages). Updates `build_runner` from 2.4.13 to 2.15.1 - [Release notes](https://github.com/dart-lang/build/releases) - [Commits](https://github.com/dart-lang/build/compare/build_runner-v2.4.13...build_runner-v2.15.1) Updates `mobx_codegen` from 2.6.2 to 2.7.7 - [Release notes](https://github.com/mobxjs/mobx.dart/releases) - [Changelog](https://github.com/mobxjs/mobx.dart/blob/main/CHANGELOG.md) - [Commits](https://github.com/mobxjs/mobx.dart/compare/mobx_codegen-2.6.2...mobx_codegen-2.7.7) Updates `mockito` from 5.4.4 to 5.6.4 - [Release notes](https://github.com/dart-lang/build/releases) - [Commits](https://github.com/dart-lang/build/commits/mockito-v5.6.4/builder_pkgs) Updates `syncfusion_flutter_charts` from 34.1.31 to 34.1.32 - [Release notes](https://github.com/syncfusion/flutter-widgets/releases) - [Commits](https://github.com/syncfusion/flutter-widgets/commits/HEAD/packages) --- updated-dependencies: - dependency-name: build_runner dependency-version: 2.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: mobx_codegen dependency-version: 2.7.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: mockito dependency-version: 5.6.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: syncfusion_flutter_charts dependency-version: 34.1.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: flutter-dependencies ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (25 Jul 26)

  build(deps): bump shell-quote (#1187) Bumps the appium-wdio-npm-security group with 1 update in the /automation/appium/wdio directory: [shell-quote](https://github.com/ljharb/shell-quote). Updates `shell-quote` from 1.8.4 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](https://github.com/ljharb/shell-quote/compare/v1.8.4...v1.10.0) --- updated-dependencies: - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: appium-wdio-npm-security ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (25 Jul 26)

  build(deps): bump json from 2.19.2 to 2.19.9 in /ios (#1186) Bumps [json](https://github.com/ruby/json) from 2.19.2 to 2.19.9. - [Release notes](https://github.com/ruby/json/releases) - [Changelog](https://github.com/ruby/json/blob/master/CHANGES.md) - [Commits](https://github.com/ruby/json/compare/v2.19.2...v2.19.9) --- updated-dependencies: - dependency-name: json dependency-version: 2.19.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (25 Jul 26)

  build(deps-dev): bump fast-uri (#1185) Bumps the appium-wdio-npm-security group with 1 update in the /automation/appium/wdio directory: [fast-uri](https://github.com/fastify/fast-uri). Updates `fast-uri` from 3.1.2 to 3.1.4 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.4) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect dependency-group: appium-wdio-npm-security ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• blokada-ci[bot] (24 Jul 26)

  sync: update translate strings to: 79dd86 (#1184) Co-authored-by: blokada-ci[bot] <276300274+blokada-ci[bot]@users.noreply.github.com>

• Karol Gusak (23 Jul 26)

  fix(appium): fail fast on blocking system alerts + capture hook-failure artifacts (#1182) * fix(dep-validate): drop the retired github-actions carve-out from the queue dependabot-auto-merge.yml removed its github-actions branch-prefix case in #1115 ("bumps flow through the same path as every other ecosystem ... we do not classify the action publisher"), but queue.mjs and SKILL.md still ported the old carve-out, so every action bump was queued as needing human validation regardless of bump level. Since the queue admits any PR with >=1 reason, a patch/minor action bump was listed as pending human review while the workflow auto-merged it -- noise, plus a false impression that a human gate exists where it does not. Delete rather than gate on majors.length: the major, offlist-file and high-risk-package rules already cover everything the workflow hands to a human, so gating would only append a duplicate reason to PRs that are queued anyway. Verified: #1177/#1179 still queue via major + high-risk; a non-major action bump now yields zero reasons (workflow files are allowlisted, and no action matches HIGH_RISK_PACKAGES), so classifyPr returns null. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * fix(appium): fail fast on blocking system alerts, capture hook-failure artifacts An "Apple Account Sign In Requested" 2FA modal sat on the CI iPhone for four consecutive appium-smoke runs. It swallows every tap while the Flutter view stays in the accessibility tree, so the gear was found and clicked successfully and the taps simply never reached the app. All 11 specs then failed in their `before all` hook on an unrelated selector: element ("~automation.screen_settings") still not existing after 15000ms acceptNotificationAlert already detected the alert and had its text, but returned silently to "leave it for the caller to handle" -- and no caller anywhere handles it. It now throws BlockingSystemAlertError with the alert text for device-level modals, while still returning silently for flow alerts. The pattern list is deliberately narrow: a missed pattern falls back to today's timeout, whereas a false positive fails a run that would have passed. Notably it must not match "Apple ID"/"Apple Account" alone -- the StoreKit sandbox purchase sheet prompts for Apple ID sign-in mid-flow (dep-validate Stage D drives purchase/restore) -- so only the 2FA approval phrasing is matched. Diagnosing this needed Appium server-log forensics because the run produced no visual evidence at all: spec screenshots are per-test, and a `before all` failure aborts before any test body runs, so the job reported "No files were found with the provided path: output/*.png". afterHook now captures a screenshot + page source on hook failure, best-effort so an artifact failure cannot mask the hook's real error. Both globs are already uploaded by the workflow. The new unit test parses the regexes out of alerts.ts rather than copying them, so it cannot drift; it covers the verbatim alert text from the red runs plus the flow alerts that must not trip it. Verified: tsc --noEmit diffed against baseline (zero new errors; the 5 reported pre-exist), test:unit 93/93, and the guard confirmed to go red when the over-broad /apple id/i pattern is reintroduced. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• blokada-ci[bot] (23 Jul 26)

  sync: update translate strings to: bc4a3 (#1183) Co-authored-by: blokada-ci[bot] <276300274+blokada-ci[bot]@users.noreply.github.com>

• dependabot[bot] (20 Jul 26)

  build(deps): bump actions/setup-python from 6 to 7 (#1181) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (20 Jul 26)

  build(deps): bump anthropics/claude-code-action (#1180) Bumps the github-actions group with 1 update: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action). Updates `anthropics/claude-code-action` from 1.0.171 to 1.0.178 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/e90deca47693f9457b72f2b53c17d7c445a87342...af0559ee4f514d1ef21826982bed13f7edc3c35e) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.178 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (20 Jul 26)

  build(deps): bump the android-gradle group in /android with 3 updates (#1178) Bumps the android-gradle group in /android with 3 updates: com.android.tools.build:gradle, org.jetbrains.kotlin.plugin.serialization and [org.jetbrains.kotlin:kotlin-stdlib](https://github.com/JetBrains/kotlin). Updates `com.android.tools.build:gradle` from 9.2.1 to 9.3.0 Updates `org.jetbrains.kotlin.plugin.serialization` from 2.4.0 to 2.4.10 Updates `org.jetbrains.kotlin:kotlin-stdlib` from 2.4.0 to 2.4.10 - [Release notes](https://github.com/JetBrains/kotlin/releases) - [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md) - [Commits](https://github.com/JetBrains/kotlin/compare/v2.4.0...v2.4.10) --- updated-dependencies: - dependency-name: com.android.tools.build:gradle dependency-version: 9.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: android-gradle - dependency-name: org.jetbrains.kotlin.plugin.serialization dependency-version: 2.4.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: android-gradle - dependency-name: org.jetbrains.kotlin:kotlin-stdlib dependency-version: 2.4.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: android-gradle ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (20 Jul 26)

  build(deps): bump the flutter-dependencies group (#1176) Bumps the flutter-dependencies group in /common with 5 updates: | Package | From | To | | --- | --- | --- | | [build_runner](https://github.com/dart-lang/build) | `2.4.13` | `2.15.1` | | [flex_color_scheme](https://github.com/rydmike/flex_color_scheme) | `8.3.1` | `8.4.0` | | [mobx_codegen](https://github.com/mobxjs/mobx.dart) | `2.6.2` | `2.7.7` | | [mockito](https://github.com/dart-lang/build/tree/master/builder_pkgs) | `5.4.4` | `5.6.4` | | [syncfusion_flutter_charts](https://github.com/syncfusion/flutter-widgets/tree/master/packages) | `34.1.30` | `34.1.31` | Updates `build_runner` from 2.4.13 to 2.15.1 - [Release notes](https://github.com/dart-lang/build/releases) - [Commits](https://github.com/dart-lang/build/compare/build_runner-v2.4.13...build_runner-v2.15.1) Updates `flex_color_scheme` from 8.3.1 to 8.4.0 - [Release notes](https://github.com/rydmike/flex_color_scheme/releases) - [Changelog](https://github.com/rydmike/flex_color_scheme/blob/master/CHANGELOG.md) - [Commits](https://github.com/rydmike/flex_color_scheme/compare/8.3.1...8.4.0) Updates `mobx_codegen` from 2.6.2 to 2.7.7 - [Release notes](https://github.com/mobxjs/mobx.dart/releases) - [Changelog](https://github.com/mobxjs/mobx.dart/blob/main/CHANGELOG.md) - [Commits](https://github.com/mobxjs/mobx.dart/compare/mobx_codegen-2.6.2...mobx_codegen-2.7.7) Updates `mockito` from 5.4.4 to 5.6.4 - [Release notes](https://github.com/dart-lang/build/releases) - [Commits](https://github.com/dart-lang/build/commits/mockito-v5.6.4/builder_pkgs) Updates `syncfusion_flutter_charts` from 34.1.30 to 34.1.31 - [Release notes](https://github.com/syncfusion/flutter-widgets/releases) - [Commits](https://github.com/syncfusion/flutter-widgets/commits/HEAD/packages) --- updated-dependencies: - dependency-name: build_runner dependency-version: 2.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: flex_color_scheme dependency-version: 8.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: mobx_codegen dependency-version: 2.7.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: mockito dependency-version: 5.6.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: syncfusion_flutter_charts dependency-version: 34.1.31 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: flutter-dependencies ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Karol Gusak (14 Jul 26)

  chore(appium): drop dead ts-node/tsconfig-paths and the ignored autoCompileOpts (#1175) WebdriverIO v9 compiles wdio.conf.ts and the specs with tsx (a direct dependency of @wdio/cli, backed by esbuild). It does not use ts-node, and `autoCompileOpts` is a v7 key that v9 ignores -- no @wdio package reads it. So all three of these are dead: - ts-node: referenced nowhere but package.json - tsconfig-paths: its ts-node companion; nothing loads it, and tsconfig.json declares no paths/baseUrl for it to resolve anyway - autoCompileOpts.tsNodeOpts in wdio.conf.ts: silently ignored They are not merely unused, they actively misdescribe how specs are built: reading them, ts-node looks load-bearing. During validation of the typescript 7 bump (#1170) that misreading produced a false "this breaks the smoke suite" report -- ts-node genuinely does break under typescript 7, which removed the JS compiler API, but nothing calls it. tsx never loads the typescript package, so the harness was never affected. Verified with ts-node and tsconfig-paths absent from node_modules: - wdio transpiles wdio.conf.ts (fails only on a deliberately bogus spec path, i.e. well past config compilation) - a real spec (paywall.spec.ts) transpiles and executes under tsx - npm run test:unit: 91/91 Pure deletion, no behavior change. Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• dependabot[bot] (14 Jul 26)

  build(deps): bump syncfusion_flutter_charts in /common (#1167) Bumps [syncfusion_flutter_charts](https://github.com/syncfusion/flutter-widgets/tree/master/packages) from 33.2.15 to 34.1.30. - [Release notes](https://github.com/syncfusion/flutter-widgets/releases) - [Commits](https://github.com/syncfusion/flutter-widgets/commits/HEAD/packages) --- updated-dependencies: - dependency-name: syncfusion_flutter_charts dependency-version: 34.1.30 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (14 Jul 26)

  build(deps-dev): bump typescript in /automation/appium/wdio (#1170) Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2. - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Karol Gusak (14 Jul 26)

  chore(deps): upgrade Flutter 3.35.2 → 3.44.6, vendor input_code_field, drop the adapty fork (#1174) * chore(deps): upgrade Flutter 3.35.2 -> 3.44.6, vendor input_code_field Flutter 3.35.2 (Aug 2025, Dart 3.9.0) was ~11 months and ~66 stable releases behind. It also silently blocked flex_color_scheme 8.4.0 and flex_seed_scheme 4.x (both require Flutter >=3.38) -- the theming packages Dependabot kept trying and failing to land (see #1149). Four things were needed. 1. input_code_field: VENDORED, and it was the only real blocker. Flutter 3.44 added `onFocusReceived` to TextInputClient. It has a default body, but `_InputCodeFieldState` `implements` the interface, so it inherits nothing and must declare the member -- and the package cannot: it is abandoned (2.0.2 is the last release, 2023-11-11, two releases ever). That single missing override failed all 50 of the compiling tests. Vendored under shared/ui/vendor/ (MIT, attribution and LICENCE kept), one method added, pub dependency dropped. Used in exactly one place: the app-lock PIN field. Notably the pigeon-12 / analyzer-5.13 hold was NOT a blocker -- resolve, `make gen` (249 outputs) and analyze all pass on Dart 3.12. 2. iOS: `build ios-framework --no-codesign`. Flutter 3.44 added native XCFramework signing and defaults it ON, which fails on any machine holding two identities for one team ("Multiple identities found for development team ..."). We already sign these in sign-ios-frameworks (the ITMS-91065 fix), so opt out and keep the pre-3.44 behaviour. 3. adapty_flutter 3.17.0 -> 3.17.1, and the blokadaorg FORK IS DROPPED. 3.17.1 ships "[Android] Fixed AGP 9 and Built-In Kotlin support" plus jvmTarget = JVM_11 -- the entire reason the fork existed. Verified: plain upstream 3.17.1 builds the AAR under Flutter 3.44's Gradle 9 module template, which the old fork (based on 3.17.0) does not. adapty_flutter is now a plain hosted dep again, so dep-validate's queue can see it as a payment surface instead of an opaque git SHA. 4. pubspec/lock/fvm pins moved to 3.44.6 (Dart 3.12.2), lock regenerated on the pinned SDK. flex_color_scheme stays 8.3.1 -- `pub get` honours the lock, so this is an SDK upgrade, not a dep-bump spree. Dependabot can now offer 8.4.0 for real. Verified locally on 3.44.6: make test 379/379; analyze exit 0; pub-verify exit 0; make -C common build-ios; iOS Dev + FamilyDev debug BUILD SUCCEEDED; make regen-android; apk-six-debug + apk-family-debug BUILD SUCCESSFUL. adapty is the payment surface and moved here, so the paywall/purchase/ restore path needs on-device validation before this merges. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * fix(i18n): load translations via AssetManifest, not the legacy JSON manifest The Flutter 3.44 build came up on a BLANK SCREEN on both the simulator and the physical device. It built clean, `make test` was 379/379 and analyze was green -- the failure was runtime only, and the device smoke caught it (every spec failed in its `before all` hook: no automation ids existed because no UI existed). Root cause, from the simulator log: [ERROR:flutter/runtime/dart_vm_initializer.cc(40)] Unhandled Exception: Unable to load asset: "AssetManifest.json". i18n_extension_importer's JSONImporter.fromAssetDirectory reads the legacy "AssetManifest.json", which Flutter replaced with AssetManifest.bin and no longer ships. The throw escaped I18nService.loadTranslations during startup, nothing caught it, and the widget tree never mounted. The package is abandoned (0.0.6 is the latest, 2023-11-13), so there is no version to bump to. It was used for exactly one method across three call sites, so drop the dependency and inline the loader on Flutter's supported AssetManifest.loadFromAssetBundle API, preserving the <language>.json filename convention. Also: --no-codesign was applied to only one of the five `flutter build ios-framework` invocations. The others (the release script and the mocked-sim helper) still fail on a multi-identity machine -- run-six-mocked hit exactly that. Fix all of them. Verified on Flutter 3.44.6: the mocked sim now renders the full home screen with translated strings; `~automation.power_toggle` resolves again (was absent); make test 379/379; analyze exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• Karol Gusak (13 Jul 26)

  fix(deps): make pubspec.lock truthful under the pinned Flutter (#1173) * chore(deps): drop unused dependency_validator dev-dependency dependency_validator was declared in common/pubspec.yaml but invoked nowhere: no CI job, no make target, no script. Its only references were its own pubspec line and the lock entry generated from it. It also cannot be upgraded. The deliberate `dependency_overrides: pigeon: 12.0.1` hold pins analyzer to 5.x (pigeon 12 requires analyzer ^5.13.0), while dependency_validator >=5.0.3 requires analyzer >=7.1.0. Version solving fails, so Dependabot's lock update silently re-resolves to 4.1.3 and lands an empty commit — an open, CI-green, zero-diff PR that regenerates forever (#1162, now closed). The only way to unblock it would be dropping the pigeon override, which pulls pigeon 26.3.4: the native Swift/Kotlin codegen migration we judged disproportionate for a dev-only tool. Removing it stops that recurring PR at the root and frees an analyzer constraint from the resolver. The lock delta is the dependency_validator stanza only; no transitive is orphaned by it (all of analyzer, args, glob, io, yaml, pubspec_parse et al. remain required by pigeon/build_runner/source_gen/mockito). Unrelated ambient lock drift that `flutter pub get` produces on this pinned Flutter 3.35.2 is deliberately excluded. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * fix(deps): make pubspec.lock truthful under the pinned Flutter The committed lock was unsatisfiable under the Flutter we pin (3.35.2). `flutter pub get --enforce-lockfile` on main fails: Would change 8 dependencies. Unable to satisfy `pubspec.yaml` using `pubspec.lock`. Cause: dependabot-core's infer_sdk_versions reads `environment.sdk` and `environment.flutter` from pubspec.yaml. We declared no `flutter:` key, so it defaulted to `any` and resolved with the newest stable Flutter. The Flutter SDK pins meta/matcher/test_api/characters/ material_color_utilities *exactly*, so Dependabot's locks carried versions (meta 1.18.0, matcher 0.12.19, ...) that cannot resolve on 3.35.2. CI ran plain `pub get`, which silently re-resolved and rewrote the lock, so it went green while building a different dependency set than the lock declared. The damage was real: of the 29 lock updates in #1149, 8 never took effect. The lock claimed flex_color_scheme 8.4.0; the app has been building 8.3.1 all along. Anything read off the lock was wrong. Three parts: - pubspec.yaml: declare the real Dart floor (3.9.0) and pin `flutter: '>=3.35.2 <3.36.0'`, which is what Dependabot resolves against. Note the floor raise sets the language version to 3.9, which also makes pub enforce the flutter *upper* bound (dart-lang/pub#4310): an off-SDK `pub get` now fails outright. Deliberate — an off-SDK resolve is what corrupted the lock. Bump in lockstep with .fvmrc. - pubspec.lock: regenerated on 3.35.2. Corrects the 8 impossible versions to what has actually been built. Not a downgrade; a correction of the record. - make pub-verify + a CI step: `pub get --enforce-lockfile` (a pure check, never rewrites) fails loudly on any future lock resolved off the pinned SDK. Runs before `make pub`, which would otherwise hide it. .vscode/settings.json points the Dart extension at the fvm SDK so the hard pin doesn't break IDE `pub get`. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• Karol Gusak (13 Jul 26)

  chore(deps): drop unused dependency_validator dev-dependency (#1172) dependency_validator was declared in common/pubspec.yaml but invoked nowhere: no CI job, no make target, no script. Its only references were its own pubspec line and the lock entry generated from it. It also cannot be upgraded. The deliberate `dependency_overrides: pigeon: 12.0.1` hold pins analyzer to 5.x (pigeon 12 requires analyzer ^5.13.0), while dependency_validator >=5.0.3 requires analyzer >=7.1.0. Version solving fails, so Dependabot's lock update silently re-resolves to 4.1.3 and lands an empty commit — an open, CI-green, zero-diff PR that regenerates forever (#1162, now closed). The only way to unblock it would be dropping the pigeon override, which pulls pigeon 26.3.4: the native Swift/Kotlin codegen migration we judged disproportionate for a dev-only tool. Removing it stops that recurring PR at the root and frees an analyzer constraint from the resolver. The lock delta is the dependency_validator stanza only; no transitive is orphaned by it (all of analyzer, args, glob, io, yaml, pubspec_parse et al. remain required by pigeon/build_runner/source_gen/mockito). Unrelated ambient lock drift that `flutter pub get` produces on this pinned Flutter 3.35.2 is deliberately excluded. Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• dependabot[bot] (13 Jul 26)

  build(deps): bump anthropics/claude-code-action (#1171) Bumps the github-actions group with 1 update: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action). Updates `anthropics/claude-code-action` from 1.0.165 to 1.0.171 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/558b1d6cab4085c7753fe402c10bef0fbb92ac7a...e90deca47693f9457b72f2b53c17d7c445a87342) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.171 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (13 Jul 26)

  build(deps-dev): bump @types/node (#1169) Bumps the appium-wdio-npm group in /automation/appium/wdio with 1 update: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node). Updates `@types/node` from 26.1.0 to 26.1.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: appium-wdio-npm ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (13 Jul 26)

  build(deps): bump the android-gradle group in /android with 2 updates (#1168) Bumps the android-gradle group in /android with 2 updates: [com.google.devtools.ksp](https://github.com/google/ksp) and com.google.firebase:firebase-bom. Updates `com.google.devtools.ksp` from 2.3.9 to 2.3.10 - [Release notes](https://github.com/google/ksp/releases) - [Commits](https://github.com/google/ksp/compare/2.3.9...2.3.10) Updates `com.google.firebase:firebase-bom` from 34.15.0 to 34.16.0 --- updated-dependencies: - dependency-name: com.google.devtools.ksp dependency-version: 2.3.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: android-gradle - dependency-name: com.google.firebase:firebase-bom dependency-version: 34.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: android-gradle ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (13 Jul 26)

  build(deps): bump the flutter-dependencies group (#1166) --- updated-dependencies: - dependency-name: build_runner dependency-version: 2.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: mobx_codegen dependency-version: 2.7.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies - dependency-name: mockito dependency-version: 5.6.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: flutter-dependencies ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (06 Jul 26)

  build(deps): bump anthropics/claude-code-action (#1165) Bumps the github-actions group with 1 update: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action). Updates `anthropics/claude-code-action` from 1.0.159 to 1.0.165 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/a92e7c70a4da9793dc164451d829089dc057a464...558b1d6cab4085c7753fe402c10bef0fbb92ac7a) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.165 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (06 Jul 26)

  build(deps-dev): bump @types/node (#1164) Bumps the appium-wdio-npm group in /automation/appium/wdio with 1 update: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node). Updates `@types/node` from 26.0.1 to 26.1.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: appium-wdio-npm ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>