Merge pull request #937 from nextcloud/refactor/pin-dependencies

refactor(deps): Pin all dependencies to the lowest possible versions

.github/renovate.json

@@ -7,7 +7,27 @@
     "dependencies"
   ],
   "rangeStrategy": "bump",
+  "lockFileMaintenance": {
+    "enabled": true
+  },
   "packageRules": [
+    {
+      "matchDatasources": ["dart-version", "flutter-version"],
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
+      "enabled": false
+    },
+    {
+      "matchManagers": ["pub"],
+      "matchDepTypes": ["dependencies"],
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
+      "enabled": false
+    },
     {
       "groupName": "built_value",
       "matchPackagePatterns": "^built"

docs/README.md

@@ -23,3 +23,6 @@ Check out our little [overview](architecture.md) of how the Neon project is buil
 
 ## [Neon workflows](workflows.md)
 We have documented various workflows for working with the mono repo structure like adding a new package.
+
+## [Dependencies](dependencies.md)
+How we pin and upgrade our dependencies

docs/dependencies.md

@@ -0,0 +1,7 @@
+# Dependencies
+
+We follow the guidelines outlined in https://dart.dev/tools/pub/dependencies with some rules and automatic workflows:
+1. We use the caret notation with the major version set to the latest major version and the minor and patch versions set to `0`. The constraint will be updated in case we need a particular feature or bug fix that was released in a newer version.
+2. Dev dependencies should be pinned to the latest versions since they do not affect consumers of our packages.
+3. Using Renovate we automatically update our dependency constraints. For non-dev dependencies this will be the latest major version, for everything else it will upgrade to the latest minor and patch versions as well. The lock files are also kept up-to-date with Renovate to compile everything with the latest available versions.
+4. The same rules and automatic workflows apply to the Dart and Flutter versions we use.

packages/app/pubspec.lock

@@ -1248,7 +1248,7 @@ packages:
     source: hosted
     version: "1.1.7"
   vector_graphics_compiler:
-    dependency: transitive
+    dependency: "direct dev"
     description:
       name: vector_graphics_compiler
       sha256: "80a13c613c8bde758b1464a1755a7b3a8f2b6cec61fbf0f5a53c94c30f03ba2e"
@@ -1392,5 +1392,5 @@ packages:
     source: hosted
     version: "3.1.2"
 sdks:
-  dart: ">=3.1.3 <4.0.0"
-  flutter: ">=3.13.6"
+  dart: ">=3.1.0 <4.0.0"
+  flutter: ">=3.13.0"

packages/app/pubspec.yaml

@@ -3,8 +3,8 @@ version: 1.0.0
 publish_to: 'none'
 
 environment:
-  sdk: '>=3.1.3 <4.0.0'
-  flutter: '>=3.13.6'
+  sdk: '>=3.1.0 <4.0.0'
+  flutter: '>=3.13.0'
 
 dependencies:
   flutter:
@@ -29,10 +29,10 @@ dependencies:
     git:
       url: https://github.com/nextcloud/neon
       path: packages/neon/neon_notifications
-  vector_graphics: ^1.1.7
+  vector_graphics: any
 
 dev_dependencies:
-  flutter_material_design_icons: ^1.1.7296
+  flutter_material_design_icons: any
   flutter_test:
     sdk: flutter
   integration_test:
@@ -41,7 +41,8 @@ dev_dependencies:
     git:
       url: https://github.com/nextcloud/neon
       path: packages/neon_lints
-  shared_preferences: ^2.2.1
+  shared_preferences: any
+  vector_graphics_compiler: any
 
 flutter:
   uses-material-design: true

packages/dynamite/dynamite/pubspec.yaml

@@ -2,20 +2,20 @@ name: dynamite
 version: 1.0.0
 
 environment:
-  sdk: '>=3.1.3 <4.0.0'
+  sdk: '>=3.1.0 <4.0.0'
 
 dependencies:
-  build: ^2.4.1
-  built_collection: ^5.1.1
-  built_value: ^8.6.3
-  checked_yaml: ^2.0.3
-  code_builder: ^4.7.0
-  collection: ^1.17.2
-  dart_style: ^2.3.2
+  build: ^2.0.0
+  built_collection: ^5.0.0
+  built_value: ^8.0.1
+  checked_yaml: ^2.0.0
+  code_builder: ^4.5.0
+  collection: ^1.0.0
+  dart_style: ^2.0.0
   intersperse: ^2.0.0
-  meta: ^1.9.1
-  path: ^1.8.3
-  version: ^3.0.2
+  meta: ^1.0.0
+  path: ^1.0.0
+  version: ^3.0.0
 
 dev_dependencies:
   build_runner: ^2.4.6

packages/dynamite/dynamite_runtime/pubspec.yaml

@@ -3,13 +3,13 @@ description: Helper package for use with dynamite.
 version: 1.0.0
 
 environment:
-  sdk: '>=3.1.3 <4.0.0'
+  sdk: '>=3.1.0 <4.0.0'
 
 dependencies:
-  built_value: ^8.6.3
-  cookie_jar: ^4.0.8
-  meta: ^1.9.1
-  universal_io: ^2.2.2
+  built_value: ^8.0.1
+  cookie_jar: ^4.0.0
+  meta: ^1.0.0
+  universal_io: ^2.0.0
 
 dev_dependencies:
   build_runner: ^2.4.6

packages/file_icons/pubspec.yaml

@@ -2,13 +2,13 @@ name: file_icons
 version: 1.0.0
 
 environment:
-  sdk: '>=3.1.3 <4.0.0'
-  flutter: '>=3.13.6'
+  sdk: '>=3.1.0 <4.0.0'
+  flutter: '>=3.13.0'
 
 dependencies:
   flutter:
     sdk: flutter
-  path: ^1.8.3
+  path: ^1.0.0
 
 dev_dependencies:
   neon_lints:

packages/neon/neon/pubspec.yaml

@@ -3,58 +3,58 @@ version: 1.0.0
 publish_to: 'none'
 
 environment:
-  sdk: '>=3.1.3 <4.0.0'
-  flutter: '>=3.13.6'
+  sdk: '>=3.1.0 <4.0.0'
+  flutter: '>=3.13.0'
 
 dependencies:
-  collection: ^1.17.1
-  crypto: ^3.0.3
-  file_picker: ^5.5.0
-  filesize: ^2.0.1
+  collection: ^1.0.0
+  crypto: ^3.0.0
+  file_picker: ^5.0.0
+  filesize: ^2.0.0
   flutter:
     sdk: flutter
-  flutter_cache_manager: ^3.3.1
-  flutter_file_dialog: ^3.0.2
-  flutter_local_notifications: ^16.0.0+1
+  flutter_cache_manager: ^3.0.0
+  flutter_file_dialog: ^3.0.0
+  flutter_local_notifications: ^16.0.0
   flutter_localizations:
     sdk: flutter
-  flutter_material_design_icons: ^1.1.7296
-  flutter_native_splash: ^2.3.3
-  flutter_svg: ^2.0.7
-  flutter_zxing: ^1.4.1
-  go_router: ^11.1.2
-  http: ^1.1.0
-  image: ^4.1.3
+  flutter_material_design_icons: ^1.0.0
+  flutter_native_splash: ^2.0.0
+  flutter_svg: ^2.0.0
+  flutter_zxing: ^1.0.0
+  go_router: ^11.0.0
+  http: ^1.0.0
+  image: ^4.0.0
   intersperse: ^2.0.0
-  intl: ^0.18.1
-  json_annotation: ^4.8.1
-  meta: ^1.9.1
+  intl: ^0.18.0
+  json_annotation: ^4.0.0
+  meta: ^1.0.0
   nextcloud:
     git:
       url: https://github.com/nextcloud/neon
       path: packages/nextcloud
-  package_info_plus: ^4.1.0
-  path: ^1.8.3
-  path_provider: ^2.1.1
-  permission_handler: ^11.0.1
-  provider: ^6.0.5
-  quick_actions: ^1.0.6
-  rxdart: ^0.27.7
-  scrollable_positioned_list: ^0.3.8
+  package_info_plus: ^4.0.0
+  path: ^1.0.0
+  path_provider: ^2.1.0
+  permission_handler: ^11.0.0
+  provider: ^6.0.0
+  quick_actions: ^1.0.0
+  rxdart: ^0.27.4
+  scrollable_positioned_list: ^0.3.0
   shared_preferences: ^2.2.1
   sort_box:
     git:
       url: https://github.com/nextcloud/neon
       path: packages/sort_box
-  sqflite: ^2.3.0
-  sqflite_common_ffi: ^2.3.0+2
+  sqflite: ^2.0.0
+  sqflite_common_ffi: ^2.2.8-2
   tray_manager: ^0.2.0
-  unifiedpush: ^5.0.1
-  unifiedpush_android: ^2.2.0
-  url_launcher: ^6.1.14
-  vector_graphics: ^1.1.7
-  window_manager: ^0.3.6
-  xml: ^6.3.0
+  unifiedpush: ^5.0.0
+  unifiedpush_android: ^2.0.0
+  url_launcher: ^6.1.0
+  vector_graphics: ^1.0.0
+  window_manager: ^0.3.0
+  xml: ^6.0.0
 
 dev_dependencies:
   build_runner: ^2.4.6

packages/neon/neon_files/pubspec.yaml

@@ -3,35 +3,35 @@ version: 1.0.0
 publish_to: 'none'
 
 environment:
-  sdk: '>=3.1.3 <4.0.0'
-  flutter: '>=3.13.6'
+  sdk: '>=3.1.0 <4.0.0'
+  flutter: '>=3.13.0'
 
 dependencies:
-  collection: ^1.17.0
+  collection: ^1.0.0
   file_icons:
     git:
       url: https://github.com/nextcloud/neon
       path: packages/file_icons
-  file_picker: ^5.5.0
-  filesize: ^2.0.1
+  file_picker: ^5.0.0
+  filesize: ^2.0.0
   flutter:
     sdk: flutter
   flutter_localizations:
     sdk: flutter
-  flutter_material_design_icons: ^1.1.7296
-  go_router: ^11.1.2
-  image_picker: ^1.0.4
-  intl: ^0.18.1
+  flutter_material_design_icons: ^1.0.0
+  go_router: ^11.0.0
+  image_picker: ^1.0.0
+  intl: ^0.18.0
   neon:
     git:
       url: https://github.com/nextcloud/neon
       path: packages/neon/neon
-  open_file: ^3.3.2
-  path: ^1.8.3
-  path_provider: ^2.1.1
-  queue: ^3.1.0+2
-  rxdart: ^0.27.7
-  share_plus: ^7.1.0
+  open_file: ^3.0.0
+  path: ^1.0.0
+  path_provider: ^2.0.0
+  queue: ^3.0.0
+  rxdart: ^0.27.0
+  share_plus: ^7.0.0
 
 dev_dependencies:
   build_runner: ^2.4.6

packages/neon/neon_news/pubspec.yaml

@@ -3,8 +3,8 @@ version: 1.0.0
 publish_to: 'none'
 
 environment:
-  sdk: '>=3.1.3 <4.0.0'
-  flutter: '>=3.13.6'
+  sdk: '>=3.1.0 <4.0.0'
+  flutter: '>=3.13.0'
 
 dependencies:
   flutter:
@@ -12,19 +12,19 @@ dependencies:
   flutter_html: ^3.0.0-beta.2
   flutter_localizations:
     sdk: flutter
-  flutter_material_design_icons: ^1.1.7296
-  go_router: ^11.1.2
-  html: ^0.15.4
-  intl: ^0.18.1
+  flutter_material_design_icons: ^1.0.0
+  go_router: ^11.0.0
+  html: ^0.15.0
+  intl: ^0.18.0
   neon:
     git:
       url: https://github.com/nextcloud/neon
       path: packages/neon/neon
-  rxdart: ^0.27.7
-  share_plus: ^7.1.0
-  url_launcher: ^6.1.14
-  wakelock_plus: ^1.1.1
-  webview_flutter: ^4.4.1
+  rxdart: ^0.27.0
+  share_plus: ^7.0.0
+  url_launcher: ^6.0.0
+  wakelock_plus: ^1.0.0
+  webview_flutter: ^4.0.0
 
 dev_dependencies:
   build_runner: ^2.4.6

packages/neon/neon_notes/pubspec.yaml

@@ -3,28 +3,28 @@ version: 1.0.0
 publish_to: 'none'
 
 environment:
-  sdk: '>=3.1.3 <4.0.0'
-  flutter: '>=3.13.6'
+  sdk: '>=3.1.0 <4.0.0'
+  flutter: '>=3.13.0'
 
 dependencies:
-  built_collection: ^5.1.1
-  crypto: ^3.0.3
+  built_collection: ^5.0.0
+  crypto: ^3.0.0
   flutter:
     sdk: flutter
   flutter_localizations:
     sdk: flutter
-  flutter_markdown: ^0.6.18
-  flutter_material_design_icons: ^1.1.7296
-  go_router: ^11.1.2
-  intl: ^0.18.1
+  flutter_markdown: ^0.6.0
+  flutter_material_design_icons: ^1.0.0
+  go_router: ^11.0.0
+  intl: ^0.18.0
   neon:
     git:
       url: https://github.com/nextcloud/neon
       path: packages/neon/neon
-  queue: ^3.1.0+2
-  rxdart: ^0.27.7
-  url_launcher: ^6.1.14
-  wakelock_plus: ^1.1.1
+  queue: ^3.0.0
+  rxdart: ^0.27.0
+  url_launcher: ^6.0.0
+  wakelock_plus: ^1.0.0
 
 dev_dependencies:
   build_runner: ^2.4.6

packages/neon/neon_notifications/pubspec.yaml

@@ -3,22 +3,22 @@ version: 1.0.0
 publish_to: 'none'
 
 environment:
-  sdk: '>=3.1.3 <4.0.0'
-  flutter: '>=3.13.6'
+  sdk: '>=3.1.0 <4.0.0'
+  flutter: '>=3.13.0'
 
 dependencies:
   flutter:
     sdk: flutter
   flutter_localizations:
     sdk: flutter
-  flutter_material_design_icons: ^1.1.7296
-  go_router: ^11.1.2
-  intl: ^0.18.1
+  flutter_material_design_icons: ^1.0.0
+  go_router: ^11.0.0
+  intl: ^0.18.0
   neon:
     git:
       url: https://github.com/nextcloud/neon
       path: packages/neon/neon
-  rxdart: ^0.27.7
+  rxdart: ^0.27.0
 
 dev_dependencies:
   build_runner: ^2.4.6

packages/neon_lints/pubspec.yaml

@@ -4,7 +4,7 @@ version: 1.0.0
 publish_to: none
 
 environment:
-  sdk: '>=3.1.3 <4.0.0'
+  sdk: '>=3.1.0 <4.0.0'
 
 dev_dependencies:
   lint_maker:

packages/nextcloud/pubspec.yaml

@@ -3,25 +3,25 @@ version: 1.0.0
 publish_to: none
 
 environment:
-  sdk: '>=3.1.3 <4.0.0'
+  sdk: '>=3.1.0 <4.0.0'
 
 dependencies:
-  built_collection: ^5.1.1
-  built_value: ^8.6.3
-  collection: ^1.17.1
-  crypto: ^3.0.3
-  crypton: ^2.2.0
+  built_collection: ^5.0.0
+  built_value: ^8.0.0
+  collection: ^1.0.0
+  crypto: ^3.0.0
+  crypton: ^2.0.0
   dynamite_runtime:
     git:
       url: https://github.com/nextcloud/neon
       path: packages/dynamite/dynamite_runtime
-  intl: ^0.18.1
-  json_annotation: ^4.8.1
-  meta: ^1.9.1
-  universal_io: ^2.2.2
-  version: ^3.0.2
-  xml: ^6.3.0
-  xml_annotation: ^2.2.0
+  intl: ^0.18.0
+  json_annotation: ^4.0.0
+  meta: ^1.0.0
+  universal_io: ^2.0.0
+  version: ^3.0.0
+  xml: ^6.0.0
+  xml_annotation: ^2.1.0
 
 dev_dependencies:
   build_runner: ^2.4.6

packages/sort_box/pubspec.yaml

@@ -2,7 +2,7 @@ name: sort_box
 version: 1.0.0
 
 environment:
-  sdk: '>=3.1.3 <4.0.0'
+  sdk: '>=3.1.0 <4.0.0'
 
 dev_dependencies:
   neon_lints:

pubspec.yaml

@@ -2,7 +2,7 @@ name: neon_workspace
 publish_to: none
 
 environment:
-  sdk: '>=3.1.3 <4.0.0'
+  sdk: '>=3.1.0 <4.0.0'
 dev_dependencies:
   commitlint_cli: ^0.7.0
   fvm: ^2.4.1