Skip to content

chore: bump the swift group across 1 directory with 3 updates - #657

Draft
dependabot[bot] wants to merge 2 commits into
masterfrom
dependabot/swift/swift-bd76c2cfb9
Draft

chore: bump the swift group across 1 directory with 3 updates#657
dependabot[bot] wants to merge 2 commits into
masterfrom
dependabot/swift/swift-bd76c2cfb9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the swift group with 3 updates in the / directory: github.com/twostraws/codescanner, github.com/airbnb/lottie-ios and github.com/21-dot-dev/swift-secp256k1.

Updates github.com/twostraws/codescanner from 2.5.1 to 2.5.2

Release notes

Sourced from github.com/twostraws/codescanner's releases.

CodeScanner v2.5.2

What's Changed

New Contributors

Full Changelog: twostraws/CodeScanner@2.5.1...2.5.2

Commits
  • 5e88643 Merge pull request #154 from alfavata/main
  • 761b6ef Update README.md
  • bc35850 Improving changes on feature detection safety
  • e24bd5a Update build.yml
  • 3936070 Merge pull request #152 from praveenperera/patch-2
  • 746c1c1 Merge pull request #149 from tataruRobert/my-feature-branch
  • ef198d3 Dispatch failure on main queue to prevent crash
  • 3423730 Add scanInterval time unit to docs
  • d89df51 Fix: In case that were no features found, it would not throw any error, and a...
  • See full diff in compare view

Updates github.com/airbnb/lottie-ios from 4.5.2 to 4.6.1

Release notes

Sourced from github.com/airbnb/lottie-ios's releases.

4.6.1

What's Changed

Full Changelog: airbnb/lottie-ios@4.6.0...4.6.1

4.6.0

What's Changed

Version Compatibility

Lottie now requires Xcode 16 / Swift 6.0 or later. Our version support policy is that Lottie supports the minimum version that is permitted by Apple for submissions to the App Store.

Full Changelog: airbnb/lottie-ios@4.5.2...4.6.0

Commits
  • f4db77d Bump version to 4.6.1
  • 3089bba Don't fail decoding when text font ascent or line height (lh) is missing ...
  • c10b740 Update embedded ZIPFoundation to 0.9.20 to prevent symlink path traversal dur...
  • 270797a Add support for IANA .lot extension as a Lottie JSON alias (#2688)
  • ff79f40 declare read-only permissions on CI workflow (#2684)
  • dc9aadd Update EmbeddedLibraries/EpoxyCore to 0.11.0 (#2681)
  • 78075a9 Fix Value Providers Not Working Correctly When Setting Gradient Colors (#2677)
  • fa391c4 Fix incorrect mask animation timing on precomp layers (#2676)
  • 3a7fb59 Optimize NSSet usage (#2659)
  • 0cd97be Add Objective-C compatible image provider (#2660)
  • Additional commits viewable in compare view

Updates github.com/21-dot-dev/swift-secp256k1 from 0.17.0 to 0.23.2

Release notes

Sourced from github.com/21-dot-dev/swift-secp256k1's releases.

0.23.2

Highlights

Other Changes

Dev-tooling Bumps

Full Changelog: 21-DOT-DEV/swift-secp256k1@0.23.1...0.23.2

0.23.1

What's Changed

Full Changelog: 21-DOT-DEV/swift-secp256k1@0.23.0...0.23.1

0.23.1-prerelease-3

What's Changed

Full Changelog: 21-DOT-DEV/swift-secp256k1@0.23.1-prerelease-2...0.23.1-prerelease-3

0.23.1-prerelease-2

What's Changed

... (truncated)

Changelog

Sourced from github.com/21-dot-dev/swift-secp256k1's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[0.23.2] - 2026-05-22

Added

  • WorkingWithKeys DocC article consolidating the previous KeyFormats, SerializingKeys, and TweakingKeys articles into a single key-handling guide covering compressed/uncompressed/x-only encoding, PEM/DER serialization, and additive/multiplicative tweak operations (#1128)
  • ECDSASigningAndBitcoinTransactions DocC article covering DER and compact encoding, low-S normalization, and a BIP-143 sighash recipe (#1128)
  • Taproot key-path spend example using SHA256.taggedHash(tag: "TapSighash", ...) and BIP-341 reference in the Schnorr documentation (#1128)
  • SharedSourcesPlugin trust note in the README installation section (#1106)

Changed

  • Moved CocoaPods, Arena, and Xcode plugin-trust instructions out of README.md into the Getting Started article; trimmed the README install section to a minimal SPM snippet and a link to the full guide (#1128)
  • Tightened DocC terminology across the catalog (e.g., "public key" → "verifying key" where used for verification; "envelope" → "wrapper"/"form" for ASN.1 structures; "party" → "co-signer" in MuSig2 contexts) and replaced plain-text BIP/RFC/paper references with inline markdown links (#1126)
  • Updated Docker base image from Swift 6.3.1 to 6.3.2 (#1119)
  • Dropped the scheduled trigger from check-subtree-updates.yml; subtree updates now run only on manual dispatch or push (#1116)

[0.23.1] - 2026-04-29

Added

  • DocC catalog articles: KeyFormats, MuSig2MultiSignatures, RecoveringPublicKeys, and SecurityConsiderations covering key representations, BIP-327 multi-signatures, ECDSA public-key recovery, and context randomization / nonce reuse / constant-time guidance (#1079)
  • EllipticCurveDiffieHellman and SilentPayments DocC articles with cross-linked examples; DocC links added throughout the README usage snippets (#1103)
  • ChoosingP256KvsZKP article and expanded ZKP landing page in the ZKP DocC catalog (#1096)
  • docc-release.yml workflow to build and upload DocC archives on tagged releases (#1096)
  • DocC validation job in apple-builds.yml (generate-documentation --warnings-as-errors) (#1096)
  • Expanded /// doc comments across Sources/Shared/ with upstream citations to libsecp256k1/secp256k1-zkp headers and BIPs 32/137/146/322/324/327/340/341/352, plus Topics sections on major types (#1096)

Changed

  • Package.swift now excludes development-only dependencies (SwiftFormat, SwiftLint, Tuist, Lefthook, swift-plugin-subtree, swift-docc-plugin) at tagged releases via Context.gitInformation?.currentTag, so consumers resolving a tagged version no longer download dev tooling (#1082)
  • Hardened workflow env usage in xcframework-release.yml and update-subtree.yml by moving ${{ github.ref_name }} / ${{ inputs.subtree_name }} into step-level env blocks (#1082)
  • Refreshed all six AGENTS.md files to focus on non-inferable content (commands, gotchas, boundaries) (#1082)
  • Adopted org-level community health defaults: project now relies on 21-DOT-DEV/.github for CODE_OF_CONDUCT.md and CONTRIBUTING.md; project-specific contributor onboarding moved to AGENTS.md (#1088)
  • Bumped SECURITY.md Supported Versions from 0.22.x to 0.23.x (#1088)
  • Updated vendored swift-crypto from 4.3.0 to 4.5.0 (#1072, #1086, #1094)
  • Updated vendored secp256k1-zkp to latest upstream (#1069)
  • Updated Docker base image from Swift 6.3.0 to 6.3.1 (#1090)
  • Updated swift-docc-plugin dev dependency from 1.4.6 to 1.5.0 (#1098)
  • Updated actions/upload-artifact from 4 to 7 and actions/download-artifact from 4 to 8 in benchmark workflows (#1066, #1067)

Fixed

... (truncated)

Commits
  • e70a10e docs: release version 0.23.2 with consolidated key-handling guide and termino...
  • 1914e20 docs: consolidate key-handling articles into unified WorkingWithKeys guide (#...
  • 64d58b9 build(deps): Bump github.com/21-dot-dev/swift-plugin-tuist from 4.195.3 to 4....
  • 81601da docs: clarify terminology and tighten phrasing across DocC catalog (#1126)
  • 1a8955f build(deps): Bump github.com/21-dot-dev/swift-plugin-tuist from 4.195.2 to 4....
  • 0aa1d74 build(deps): Bump github.com/21-dot-dev/swift-plugin-tuist from 4.195.1 to 4....
  • 7f0f85f build(deps): Bump github.com/csjones/lefthook-plugin from 2.1.6 to 2.1.8 (#1123)
  • 29634a6 build(deps): Bump github.com/21-dot-dev/swift-plugin-tuist from 4.194.3 to 4....
  • 0cf4a80 build(deps): Bump github.com/21-dot-dev/swift-plugin-tuist from 4.194.1 to 4....
  • 895983e build(deps): Bump github.com/21-dot-dev/swift-plugin-tuist from 4.193.4 to 4....
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file swift_package_manager Pull requests that update swift_package_manager code labels Aug 5, 2026
@greptile-apps

greptile-apps Bot commented Aug 5, 2026

Copy link
Copy Markdown

PR author is in the excluded authors list.

@jvsena42

jvsena42 commented Aug 6, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@jvsena42

jvsena42 commented Aug 6, 2026

Copy link
Copy Markdown
Member

@dependabot recreate

@dependabot
chore: bump the swift group across 1 directory with 3 updates
4a149c1 
Bumps the swift group with 3 updates in the / directory: [github.com/twostraws/codescanner](https://github.com/twostraws/CodeScanner), [github.com/airbnb/lottie-ios](https://github.com/airbnb/lottie-ios) and [github.com/21-dot-dev/swift-secp256k1](https://github.com/21-DOT-DEV/swift-secp256k1).


Updates `github.com/twostraws/codescanner` from 2.5.1 to 2.5.2
- [Release notes](https://github.com/twostraws/CodeScanner/releases)
- [Commits](twostraws/CodeScanner@2.5.1...5e88643)

Updates `github.com/airbnb/lottie-ios` from 4.5.2 to 4.6.1
- [Release notes](https://github.com/airbnb/lottie-ios/releases)
- [Commits](airbnb/lottie-ios@4.5.2...f4db77d)

Updates `github.com/21-dot-dev/swift-secp256k1` from 0.17.0 to 0.23.2
- [Release notes](https://github.com/21-DOT-DEV/swift-secp256k1/releases)
- [Changelog](https://github.com/21-DOT-DEV/swift-secp256k1/blob/main/CHANGELOG.md)
- [Commits](21-DOT-DEV/swift-secp256k1@0.17.0...e70a10e)

---
updated-dependencies:
- dependency-name: github.com/21-dot-dev/swift-secp256k1
  dependency-version: 0.23.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: swift
- dependency-name: github.com/airbnb/lottie-ios
  dependency-version: 4.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: swift
- dependency-name: github.com/twostraws/codescanner
  dependency-version: 2.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: swift
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore: bump the swift group with 3 updates chore: bump the swift group across 1 directory with 3 updates Aug 6, 2026
@dependabot
dependabot Bot force-pushed the dependabot/swift/swift-bd76c2cfb9 branch from 4ec23c8 to 4a149c1 Compare August 6, 2026 10:04
@jvsena42

jvsena42 commented Aug 6, 2026

Copy link
Copy Markdown
Member

CI is failing on all four build jobs with:

Bitkit.xcodeproj: error: Missing package product 'secp256k1'
  (in targets 'Bitkit', 'BitkitTests', 'BitkitNotification')

swift-secp256k1 0.23.2 renames the secp256k1 product to P256K and moves the raw C API into a separate libsecp256k1 product that the Swift wrapper imports internally rather than re-exporting. This bump only updated Package.resolved, so the three targets still reference a product that no longer exists.

Picking it up is not a rename — it needs:

  • both P256K and libsecp256k1 added as product dependencies on Bitkit, BitkitTests and BitkitNotification
  • Crypto.swift split across both modules (P256K for ECDH, libsecp256k1 for secp256k1_ecdsa_sign_recoverable / secp256k1_ec_pubkey_create) and secp256k1.KeyAgreement.* renamed to P256K.KeyAgreement.*
  • WatchOnlyAccountService.swift moved to libsecp256k1
  • -skipPackagePluginValidation added to every scripted xcodebuild invocation: 0.23.2 also ships a SharedSourcesPlugin build-tool plugin, and xcodebuild refuses to run an untrusted plugin non-interactively (Validate plug-in "SharedSourcesPlugin" in package "swift-secp256k1"), so CI stays red without it

That touches push-notification payload decryption and watch-only key parsing, so it is being split into its own PR. swift-secp256k1 is going back to 0.17.0 here so the CodeScanner 2.5.2 and Lottie 4.6.1 bumps can land.

Verified locally on the reverted branch: build succeeds and the unit-test suite passes (756 tests, 0 failures).

@jvsena42 jvsena42 self-assigned this Aug 6, 2026
@jvsena42
jvsena42 enabled auto-merge August 6, 2026 17:32
@jvsena42 jvsena42 mentioned this pull request Aug 6, 2026
Open
4 tasks
@jvsena42
jvsena42 requested review from ovitrif and pwltr August 7, 2026 12:01
pwltr
pwltr reviewed Aug 7, 2026
View reviewed changes
Comment thread Bitkit.xcodeproj/project.pbxproj
requirement = {
kind = upToNextMajorVersion;
minimumVersion = 2.5.1;
minimumVersion = 2.5.2;

@pwltr pwltr Aug 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why did it tighten minimumVersion here but not for Lottie? We only have 3 external dependencies, so I think we can afford to be strict on their versions - In light of recent security concerns - and get into the habit of reading their change sets.

@jvsena42
jvsena42 marked this pull request as draft August 7, 2026 13:58
auto-merge was automatically disabled August 7, 2026 13:58

Pull request was converted to draft

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pwltr pwltr pwltr left review comments
@jvsena42 jvsena42 jvsena42 approved these changes
@ovitrif ovitrif Awaiting requested review from ovitrif

At least 1 approving review is required to merge this pull request.

Assignees

@jvsena42 jvsena42

Labels

dependencies Pull requests that update a dependency file swift_package_manager Pull requests that update swift_package_manager code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jvsena42 @pwltr