fix(ci): pin GRDB fork back to 3.0.1 and stop dependabot downgrades - #8
Merged
Conversation
The thebrowsercompany/GRDB.swift fork's tags are not comparable semver: "3.0.1" vendors GRDB 7.4.1 + SQLCipher 4.7.0, while "6.6.0" vendors the older upstream GRDB 6.6.0, whose C-string calls (strcmp) no longer compile on Swift 6.2. Dependabot's tag-order "bump" (#6) therefore downgraded the at-rest crypto layer and broke CI and CodeQL autobuild on main, while the PR #7 head (still on 3.0.1) built green on the same runner. Revert the pin and ignore this dependency in dependabot; bump it manually after a local build only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
6.6.0back to3.0.1— the fork's tags are not comparable semver:3.0.1vendors GRDB 7.4.1 + SQLCipher 4.7.0, while6.6.0vendors the older upstream GRDB 6.6.0, whosestrcmpcalls no longer compile on Swift 6.2.main(cannot find 'strcmp' in scope), while PR Feat/spoken summary confirm loop #7's head — still on 3.0.1 — built green on the same runner image.ignorefor this dependency plus comments inPackage.swiftso the pin is only ever bumped manually after a local build.Test plan
swift package resolvere-pins revisione4135b5(3.0.1)swift test: 249 tests in 41 suites pass locally🤖 Generated with Claude Code