From ccc4bc0c931ab1dbc7e86ebb891e630b8320b17d Mon Sep 17 00:00:00 2001
From: Andreas Mueller <herban.mueller@gmail.com>
Date: Sun, 5 Jul 2026 10:42:19 +0200
Subject: [PATCH] fix(ci): pin GRDB fork back to 3.0.1 and stop dependabot
 downgrades

The thebrowsercompany/GRDB.swift fork's tags are not comparable semver:
"3.0.1" vendors GRDB 7.4.1 + SQLCipher 4.7.0, while "6.6.0" vendors the
older upstream GRDB 6.6.0, whose C-string calls (strcmp) no longer compile
on Swift 6.2. Dependabot's tag-order "bump" (#6) therefore downgraded the
at-rest crypto layer and broke CI and CodeQL autobuild on main, while the
PR #7 head (still on 3.0.1) built green on the same runner.

Revert the pin and ignore this dependency in dependabot; bump it manually
after a local build only.
---
 .github/dependabot.yml | 6 ++++++
 Package.resolved       | 6 +++---
 Package.swift          | 6 +++++-
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1b9a3a4..7d6f121 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,6 +5,12 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 10
+    ignore:
+      # The thebrowsercompany fork's tags are not comparable semver: "3.0.1"
+      # vendors GRDB 7.4.1, while "6.6.0" vendors the older GRDB 6.6.0 that
+      # fails to compile on Swift 6.2. A tag-order "bump" silently downgrades
+      # the at-rest crypto layer — update this pin manually, never here.
+      - dependency-name: "github.com/thebrowsercompany/grdb.swift"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
diff --git a/Package.resolved b/Package.resolved
index d723f48..0a5d054 100644
--- a/Package.resolved
+++ b/Package.resolved
@@ -1,13 +1,13 @@
 {
-  "originHash" : "1f38c1151331ecad865d5acd2e44b4c60e9e4d8eef78fd6bcb8746151c491f56",
+  "originHash" : "34b6786684a34342a6a227cc4c1a71731c467cee09e48fff89002984abe3b07b",
   "pins" : [
     {
       "identity" : "grdb.swift",
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/thebrowsercompany/GRDB.swift",
       "state" : {
-        "revision" : "c3cc998fc14efa356259e5d01d8910e82de080ad",
-        "version" : "6.6.0"
+        "revision" : "e4135b50820ed0a6c69addc2959787b852715574",
+        "version" : "3.0.1"
       }
     }
   ],
diff --git a/Package.swift b/Package.swift
index cc7b3bd..8ecc1ae 100644
--- a/Package.swift
+++ b/Package.swift
@@ -27,7 +27,11 @@ let package = Package(
         // GRDB packaged with SQLCipher Community Edition as an XCFramework, the
         // only clean way to get encrypted SQLite over SwiftPM (GRDB 7.4.1 +
         // SQLCipher 4.7.0). Pinned exactly because it is the at-rest crypto layer.
-        .package(url: "https://github.com/thebrowsercompany/GRDB.swift", exact: "6.6.0"),
+        // NOTE: this fork's tags are NOT comparable semver — "3.0.1" vendors
+        // GRDB 7.4.1 while "6.6.0" vendors the older GRDB 6.6.0, which no
+        // longer compiles on Swift 6.2 (`strcmp` out of scope). Dependabot is
+        // told to ignore this dependency; bump only after building locally.
+        .package(url: "https://github.com/thebrowsercompany/GRDB.swift", exact: "3.0.1"),
     ],
     targets: [
         // MARK: Modules