--- name: update-dependencies description: Weekly dependency update workflow for Sesori Apps Monorepo. Updates every pubspec.yaml across the bridge and client workspaces plus standalone packages, regenerates all lockfiles, re-resolves iOS/macOS SwiftPM native dependencies (Package.resolved), updates Fastlane/Gemfile versions, handles conflicts, and verifies via analyze/test/codegen. ---

<objective> Systematically update all project dependencies across both Dart workspaces and standalone packages while maintaining stability, tracking conflicts, and ensuring proper commit hygiene. </objective>

<project_structure> <workspaces> The repo has two Dart workspaces and two standalone packages. Workspace members share a single resolution; standalone packages resolve independently.

**Client workspace** (`client/pubspec.yaml` is the workspace root, has `flutter` env constraint):

- `client/pubspec.yaml` — workspace root, env only - `client/module_auth/pubspec.yaml` - `client/module_core/pubspec.yaml` - `client/module_prego/pubspec.yaml` (Flutter package — theme/assets) - `client/module_desktop_core/pubspec.yaml` (pure Dart desktop business logic) - `client/design_catalog/pubspec.yaml` (Flutter design-system catalog) - `client/app/pubspec.yaml` (Flutter app — Firebase, flutter_bloc, etc.) - `client/desktop/pubspec.yaml` (Flutter desktop app)

**Bridge workspace** (`bridge/pubspec.yaml` is the workspace root, pure Dart):

- `bridge/pubspec.yaml` — workspace root, env only - `bridge/sesori_plugin_interface/pubspec.yaml` - `bridge/sesori_bridge_foundation/pubspec.yaml` (depends on `sesori_plugin_interface`; bridge-wide shared primitives) - `bridge/sesori_plugin_runtime/pubspec.yaml` (depends on `sesori_plugin_interface`) - `bridge/sesori_plugin_opencode/pubspec.yaml` - `bridge/sesori_plugin_codex/pubspec.yaml` - `bridge/sesori_plugin_acp/pubspec.yaml` - `bridge/sesori_plugin_cursor/pubspec.yaml` - `bridge/sesori_plugin_omp/pubspec.yaml` - `bridge/sesori_plugin_claude/pubspec.yaml` - `bridge/sesori_plugin_pi/pubspec.yaml` - `bridge/sesori_plugin_hermes/pubspec.yaml` - `bridge/app/pubspec.yaml` (CLI relay server)

**Standalone packages** (NOT in any workspace — resolve independently with their own lockfile):

- `shared/sesori_shared/pubspec.yaml` — pure Dart; consumed by both workspaces via `path:` dep - `shared/no_slop_linter/pubspec.yaml` — pure Dart analyzer plugin; consumed by `module_prego` via `path:` dev_dep

**IMPORTANT**: Update `shared/sesori_shared` FIRST because both workspaces depend on it.

**DO NOT update `shared/no_slop_linter`** as part of this workflow. Its analyzer/`_fe_analyzer_shared` constraints span multiple majors intentionally and break easily — bumps are done manually, less often, by a human. Skip its pubspec edits in Phase 3, but still run `make analyze`/`make test` against it via the shared `Makefile` for verification. </workspaces>

<ios_files> Sesori iOS is **Swift Package Manager only** — there is no Podfile, and CocoaPods is not part of the iOS dependency graph. Do not run `pod install` or attempt to add Podfile handling here.

- `client/app/ios/Gemfile` (fastlane gem only) - `client/app/ios/Gemfile.lock` </ios_files>

<android_files>

- `client/app/android/Gemfile` (fastlane gem) - `client/app/android/Gemfile.lock` </android_files>

<swiftpm_files> iOS and macOS pull native dependencies (Firebase, Google SDKs, leveldb, gRPC, etc.) via Swift Package Manager. The resolved native versions are pinned in `Package.resolved` lockfiles. **All four tracked copies matter** — the project copy and the workspace copy, per platform:

- `client/app/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved` - `client/app/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved` - `client/app/ios/Runner.xcworkspace/xcshareddata/swiftpm/Package.resolved` - `client/app/macos/Runner.xcworkspace/xcshareddata/swiftpm/Package.resolved`

`flutter build --config-only` regenerates only the **project** copies. The `Runner.xcworkspace` copies are what Xcode actually consumes when a build targets the workspace — which is exactly what the iOS release lanes do (`build_app(workspace: "Runner.xcworkspace", ...)` in `client/app/ios/fastlane/Fastfile`). Leaving them stale means the shipped TestFlight/App Store build silently links the OLD native SDKs even though the PR claims to have updated them. Verified 2026-07-21: with the workspace copy stale, `xcodebuild -resolvePackageDependencies -workspace Runner.xcworkspace -scheme Runner` resolved AppCheck 11.3.0 / GoogleUtilities 8.1.1 while the project copy already said 11.3.1 / 8.1.2.

Both copies describe the same package graph, so after Phase 5.1 they must end up with identical `pins`.

These lockfiles change on most weekly runs because native SDK patch releases land continuously, **independent of pubspec.yaml**. They MUST be re-resolved every run (Phase 5). Use `flutter build --config-only` for the project copies; a bare `xcodebuild -resolvePackageDependencies` honors whatever pins already exist and silently no-ops, so it only re-resolves the workspace copies once their lockfile has been deleted. Skipping (or using the wrong resolve command) is a silent, recurring miss — e.g. one past run bumped firebase-ios-sdk but left GoogleUtilities/nanopb/promises stale; another run's bare `xcodebuild` resolve reported "no changes" while a `flutter build --config-only` picked up GTMSessionFetcher 4.5.0→5.3.0, GoogleUtilities 8.1.0→8.1.1, nanopb, and Promises. </swiftpm_files> </project_structure>

<process> <phase name="0. Preflight Discovery"> <description>Enumerate the ACTUAL dependency surface and reconcile it against the documented lists in `<project_structure>`. The hardcoded lists below WILL go stale as packages are added — a package missing from the tables is the single most common failure of this workflow (e.g. `bridge/sesori_plugin_runtime` was missed for weeks). Treat what you discover here as authoritative; the tables are only the expected reference.</description>

<step name="0.1">List every source pubspec (excludes build artifacts, codegen output, and worktrees):

```bash find . -name pubspec.yaml -not -path '*/build/*' -not -path '*/.dart_tool/*' -not -path './.worktrees/*' | sort ```

Cross-check the output against the package inventory in `<project_structure>`. If a pubspec appears that is NOT listed there (a newly added workspace member), treat it as in-scope for THIS run — add it to every per-file step below (env constraints in 1.2, outdated check in 2.1, constraint bumps in 3.1) — AND update the inventory + env table in this skill so future runs inherit it. The ONLY pubspec excluded from edits is `shared/no_slop_linter/pubspec.yaml`. </step>

<step name="0.2">List the authoritative workspace members straight from the workspace roots — every member here MUST be processed in Phases 1–3:

```bash sed -n '/^workspace:/,$p' bridge/pubspec.yaml sed -n '/^workspace:/,$p' client/pubspec.yaml ``` </step>

<step name="0.3">List the iOS/macOS SwiftPM lockfiles that Phase 5 will refresh (expect exactly four — a project copy and a workspace copy per platform; these are native deps and are in scope):

```bash git ls-files | grep 'Package.resolved' ``` </step> </phase>

<phase name="1. Environment Setup"> <description>Ensure Flutter/Dart is at latest stable version, align environment constraints, and clean lock files</description>

<step name="1.1">Check current Flutter version and update if needed:

```bash flutter --version asdf install flutter latest asdf set flutter latest # asdf 0.16+ canonical form; equivalent to `asdf local` on older versions flutter --version ```

If `flutter --version` still reports the old version after `asdf set`, run `asdf reshim flutter` (or open a new shell) and re-run `flutter --version`. </step>

<step name="1.2">Check and update environment constraints in all pubspec.yaml files **except `shared/no_slop_linter/pubspec.yaml`** (manually managed).

Get the current Dart SDK version bundled with Flutter:

```bash flutter --version ```

Note the Dart version (e.g., "Dart 3.11.0") and Flutter version (e.g., "Flutter 3.41.0").

For each pubspec.yaml below, read its `environment` section and update only the keys present. **Preserve the existing constraint syntax per file** — do not normalize between caret and range forms.

**SKIP `shared/no_slop_linter/pubspec.yaml` entirely** — its env constraint (and all other deps) are managed manually by a human.

| File | Has `sdk` | Has `flutter` | Constraint style | |------|-----------|---------------|------------------| | `client/pubspec.yaml` | ✅ | ✅ | caret (`^3.13.0`) + range (`">=3.47.0 <3.48.0"`) | | `client/app/pubspec.yaml` | ✅ | — | caret | | `client/module_auth/pubspec.yaml` | ✅ | — | caret | | `client/module_core/pubspec.yaml` | ✅ | — | caret | | `client/module_prego/pubspec.yaml` | ✅ | ✅ | caret + range | | `client/module_desktop_core/pubspec.yaml` | ✅ | — | caret | | `client/design_catalog/pubspec.yaml` | ✅ | ✅ | caret + range | | `client/desktop/pubspec.yaml` | ✅ | — | caret | | `bridge/pubspec.yaml` | ✅ | — | caret | | `bridge/app/pubspec.yaml` | ✅ | — | caret | | `bridge/sesori_plugin_interface/pubspec.yaml` | ✅ | — | caret | | `bridge/sesori_bridge_foundation/pubspec.yaml` | ✅ | — | caret | | `bridge/sesori_plugin_runtime/pubspec.yaml` | ✅ | — | caret | | `bridge/sesori_plugin_opencode/pubspec.yaml` | ✅ | — | caret | | `bridge/sesori_plugin_codex/pubspec.yaml` | ✅ | — | caret | | `bridge/sesori_plugin_acp/pubspec.yaml` | ✅ | — | caret | | `bridge/sesori_plugin_cursor/pubspec.yaml` | ✅ | — | caret | | `bridge/sesori_plugin_omp/pubspec.yaml` | ✅ | — | caret | | `bridge/sesori_plugin_claude/pubspec.yaml` | ✅ | — | caret | | `bridge/sesori_plugin_pi/pubspec.yaml` | ✅ | — | caret | | `bridge/sesori_plugin_hermes/pubspec.yaml` | ✅ | — | caret | | `shared/sesori_shared/pubspec.yaml` | ✅ | — | caret |

Example:

```yaml environment: sdk: ^DART_VERSION flutter: ">=FLUTTER_VERSION <NEXT_MINOR" # client/pubspec.yaml only ```

</step>

<step name="1.3">Commit if environment constraints changed:

```bash git diff .tool-versions git diff --name-only -- '*.yaml' git add .tool-versions $(git diff --name-only -- '*.yaml') git commit -m "chore: update Flutter/Dart environment constraints

- Update environment constraints in all pubspec.yaml files - Update Flutter SDK version in .tool-versions (if changed)" ```

Skip this commit if no environment changes were needed. </step>

<step name="1.4">Delete all pubspec.lock files except `shared/no_slop_linter/pubspec.lock` (the linter is excluded from this workflow — its lock must remain untouched so transitive resolution doesn't shift):

```bash find . -name "pubspec.lock" \ -not -path "./.worktrees/*" \ -not -path "./shared/no_slop_linter/*" \ -delete ```

</step> </phase>

<phase name="2. Dependency Analysis"> <description>Check for available updates across all packages</description>

<step name="2.1">Run outdated check for each package. Workspaces resolve as a unit (run from workspace root); standalone packages resolve individually.

**Standalone (`shared/sesori_shared` only — `no_slop_linter` is excluded):**

```bash (cd shared/sesori_shared && dart pub outdated) ```

**Client workspace** (one resolution covers all members; run `outdated` per-member to see direct deps per package — `flutter pub outdated` for Flutter packages, `dart pub outdated` for pure-Dart members):

```bash set -e (cd client && flutter pub get) (cd client/module_auth && dart pub outdated) # pure Dart (cd client/module_core && dart pub outdated) # pure Dart (cd client/module_prego && flutter pub outdated) # Flutter (flutter: sdk: flutter) (cd client/module_desktop_core && dart pub outdated) # pure Dart (cd client/design_catalog && flutter pub outdated) # Flutter design catalog (cd client/app && flutter pub outdated) # Flutter app (cd client/desktop && flutter pub outdated)