MOEN-45889: Dependency Update 2026-07-08

[sdk-bot-user]

Summary

• Updated android-bom and plugin-base-bom to the latest versions from Maven Central.
  Only modules with changed artifacts were updated.
  Both the Android package and public-facing package changelogs have been updated.
• Updated MoEngagePlugin* pinned versions and MoEngage-iOS-SDK floor.
  Podspec and Package.swift files refreshed; iOS-package CHANGELOG and public CHANGELOG updated.

Android outcome: success · iOS outcome: success

[moe-hodor]

🚪 Hodor is reviewing this PR... 👀

[moe-hodor]

⚠️ Branching Strategy — policy violation

Branch: MOEN-45889/dependency_update — category: unknown, impact: ❓ Unknown CFR

Branching Strategy — unrecognized branch prefix

Branch MOEN-45889/dependency_update doesn't use a recognized prefix. Per the Branching Strategy, use:

• feature/ — planned work (neutral CFR)
• patch/ — weekly maintenance (neutral CFR)
• hotfix/ — emergency fix (⚠ increases CFR)
• revert/ — rollback (⚠ increases CFR)

---

Posted by Hodor's branching-strategy gate. Per the Branching Strategy, branches must use feature/, patch/, hotfix/, or revert/ prefix. This comment is posted directly by the gate (not by the agent) to guarantee policy visibility.

[moe-hodor]

⚠️ Warning — Inconsistent BOM version: This file updates moengageNativeBomVersion to 4.0.0 but does NOT update moengagePluginBaseBomVersion (still at 3.0.1).

All other Android modules in this PR update BOTH:

• android-bom 2.2.2 → 4.0.0
• plugin-base-bom 3.0.1 → 3.1.0

Impact: Geofence module will use plugin-base-bom:3.0.1 while cards/inbox/personalize/flutter use 3.1.0. This version skew may cause runtime conflicts if the newer BOM has breaking changes.

Fix: Change line 28 to:

moengagePluginBaseBomVersion = "3.1.0"

If geofence intentionally uses an older plugin-base-bom, add a comment explaining why.

[moe-hodor]

💡 Suggestion — Fill in release metadata: All CHANGELOG files have placeholder headers (# Release Date, ## Release Version) without actual dates/versions.

Before merging:

1. Replace # Release Date with the actual release date (e.g., # 2026-07-08 to match the PR title)
2. Replace ## Release Version with the actual version number (e.g., ## 6.6.0)
3. Repeat for all 6 affected CHANGELOG files:
   • moengage_cards/CHANGELOG.md
   • moengage_flutter/CHANGELOG.md
   • moengage_geofence/CHANGELOG.md
   • moengage_inbox/CHANGELOG.md
   • moengage_personalize/CHANGELOG.md
   • Platform-specific CHANGELOGs (Android/iOS)

This ensures the release notes are ready for publication.

[moe-hodor]

Review Summary

Branching & CFR: MOEN-45889/dependency_update — category: unknown, impact: ❓ Unknown CFR

⚠️ Branching Strategy — unrecognized branch prefix — Branch MOEN-45889/dependency_update doesn't use a recognized prefix. Per the Branching Strategy, use:

• feature/ — planned work (neutral CFR)
• patch/ — weekly maintenance (neutral CFR)
• hotfix/ — emergency fix (⚠ increases CFR)
• revert/ — rollback (⚠ increases CFR)

---

Quality Gates

✅ PR Size: 159 lines changed across 30 files — Good size
✅ Tests: No test logic changes required for dependency updates
✅ Migrations: No migration files
⚠️ Config: 15 config file(s) modified (BOM version bumps)
⚠️ Duplication: Similar changes across multiple modules (expected for monorepo dependency updates)

---

Jira Alignment

Ticket: MOEN-45889 — Flutter Major Version Update

⚠️ Scope Mismatch: The Jira ticket describes a major version update (Melos 3.1.0→8.1.0, Dart SDK bump, Flutter Gradle plugin migration). This PR only updates native Android/iOS SDK dependency versions — no Melos, Dart SDK, or Gradle plugin changes are present.

Expected in ticket but missing:

• Melos upgrade to 8.1.0
• Dart SDK floor bump to >=3.6.0
• Flutter constraint bump to >=3.27.0
• Flutter Gradle plugin declarative migration
• Migration of melos.yaml to pubspec.yaml

This PR appears to be a prerequisite dependency update step, not the full ticket implementation.

---

Issues Found

• ⚠️ 1 Warning (consistency issue)
• 💡 1 Suggestion (documentation)

---

Key Concerns

1. Inconsistent BOM Update — moengage_geofence_android only updates android-bom but not plugin-base-bom, while all other modules update both. This creates version inconsistency across the monorepo.

2. Placeholder CHANGELOG entries — All 6 CHANGELOG files have # Release Date and ## Release Version without actual dates/versions filled in.

---

What's Good

✅ Consistent version bumps across all modules (except geofence)
✅ Both Android and iOS dependencies updated in lockstep
✅ No logic changes — pure dependency update reduces risk
✅ Bot-generated PR ensures mechanical accuracy

---

Regression Risk

Low — This PR only updates BOM (Bill of Materials) versions. The actual SDK behavior changes are encapsulated in the upstream MoEngage native SDKs (android-bom:4.0.0, iOS SDK 10.14.0). No Flutter/Dart/Kotlin/Swift code logic is modified in this PR.

Recommended: Verify the upstream SDK release notes for breaking changes:

• Android BOM 2.2.2 → 4.0.0 (major version jump)
• iOS SDK → 10.14.0

---

Verdict

COMMENT — One consistency warning needs addressing before merge. The dependency updates themselves are low-risk since no application logic changed.