chore(deps): consolidate all open Dependabot updates

.github/workflows/analyze.yml

@@ -24,12 +24,12 @@ jobs:
 
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/build.yml

@@ -24,12 +24,12 @@ jobs:
 
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -41,7 +41,7 @@ jobs:
           cache: true
 
       - name: Restore Gradle cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.gradle/caches
@@ -63,12 +63,12 @@ jobs:
 
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -80,7 +80,7 @@ jobs:
           cache: true
 
       - name: Restore CocoaPods cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             apps/playground/ios/Pods

.github/workflows/pana.yml

@@ -24,12 +24,12 @@ jobs:
 
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/pub-publish-dryrun.yml

@@ -24,12 +24,12 @@ jobs:
 
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/release.yml

@@ -24,12 +24,12 @@ jobs:
 
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -48,7 +48,7 @@ jobs:
           echo "Release tag '$TAG' OK."
 
       - name: Set up Dart for pub.dev OIDC
-        uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
+        uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1 # v1.8.0
 
       - name: Set up Flutter
         uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0

.github/workflows/sonarqube.yml

@@ -27,12 +27,12 @@ jobs:
 
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -51,7 +51,7 @@ jobs:
         run: make test-sdk-coverage
 
       - name: SonarQube Scan
-        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
+        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/test.yml

@@ -44,12 +44,12 @@ jobs:
 
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

README.md

@@ -116,12 +116,16 @@ A standard `packages/*` + `apps/*` monorepo split.
 
 ## Monorepo tooling
 
-Uses **Dart pub workspaces** (Dart ≥ 3.6) + **[Melos](https://melos.invertase.dev) 7**.
+Uses **Dart pub workspaces** + **[Melos](https://melos.invertase.dev) 8**.
+Developing in this repo needs **Dart ≥ 3.12** (the root `pubspec.yaml`
+constraint). The published `formbricks` package keeps a lower floor of
+Dart ≥ 3.6 / Flutter ≥ 3.27 for consumers — workspaces need Dart ≥ 3.6 and
+Melos 8.6.0 needs Dart ≥ 3.9, so the repo constraint is the binding one.
 
 - The root `pubspec.yaml` declares `workspace:` members. Each member sets
   `resolution: workspace`, so the whole repo shares **one** lockfile and one
   resolved dependency graph — no version drift between SDK and demo app.
-- Melos 7 sits on top of native workspaces and adds cross-package scripts
+- Melos 8 sits on top of native workspaces and adds cross-package scripts
   (analyze / test / format across everything at once). Its config lives under
   the `melos:` key in the root `pubspec.yaml` (Melos 7 dropped `melos.yaml`).
 

packages/formbricks/pubspec.yaml

@@ -25,11 +25,11 @@ dependencies:
   http: ^1.2.0
   shared_preferences: ^2.3.0
   clock: ^1.1.2
-  webview_flutter: ^4.13.0
+  webview_flutter: ^4.14.1
   # Android-specific APIs are used to disable file/content access.
-  webview_flutter_android: ^4.13.0
+  webview_flutter_android: ^4.14.1
   url_launcher: ^6.3.0
-  connectivity_plus: ^7.1.1
+  connectivity_plus: ^7.3.1
 
 dev_dependencies:
   flutter_test:

pubspec.lock

@@ -61,10 +61,10 @@ packages:
     dependency: transitive
     description:
       name: cli_launcher
-      sha256: "35cf15a3ffaeb9c11849eaa0afba761bb76dceb42d050532bfd3e1299c9748cd"
+      sha256: "96883f87648524292e24e2cc6a369fbdf64883473fe3e3ddadd3d857bf16a484"
       url: "https://pub.dev"
     source: hosted
-    version: "0.3.3+1"
+    version: "0.3.3+2"
   cli_util:
     dependency: transitive
     description:
@@ -93,10 +93,10 @@ packages:
     dependency: transitive
     description:
       name: connectivity_plus
-      sha256: "62ffa266d9a23b79fb3fcbc206afc00bb979417ba57b1324c546b5aab95ba057"
+      sha256: "762c99f890ca8bf87f7337236f99edd42793843bc6c3631da294a76653a54bd0"
       url: "https://pub.dev"
     source: hosted
-    version: "7.1.1"
+    version: "7.3.1"
   connectivity_plus_platform_interface:
     dependency: transitive
     description:
@@ -291,10 +291,10 @@ packages:
     dependency: "direct dev"
     description:
       name: melos
-      sha256: "5fc1a858e3d90fdc42f2f423b95f901214bbc3d9e80c99125d9352f12453721d"
+      sha256: f8f6110bdac663034301c56dec02381de08f81b593175fee4c5714874d3d6dcd
       url: "https://pub.dev"
     source: hosted
-    version: "7.8.2"
+    version: "8.6.0"
   meta:
     dependency: transitive
     description:
@@ -656,18 +656,18 @@ packages:
     dependency: transitive
     description:
       name: webview_flutter
-      sha256: a3da219916aba44947d3a5478b1927876a09781174b5a2b67fa5be0555154bf9
+      sha256: d53e1ccf5516f25017e3c9d44c39034db352d20fa34fe200674270242c2c5111
       url: "https://pub.dev"
     source: hosted
-    version: "4.13.1"
+    version: "4.14.1"
   webview_flutter_android:
     dependency: transitive
     description:
       name: webview_flutter_android
-      sha256: a97db7a44f8e71af2f3971c45550a08cce1fb60059c1b8e534251e6cfb753490
+      sha256: "4de8b3d1ff4ebe1bdb42e68a5e4f809194a3cb0117a8f495f590004f00da3964"
       url: "https://pub.dev"
     source: hosted
-    version: "4.13.0"
+    version: "4.14.1"
   webview_flutter_platform_interface:
     dependency: transitive
     description:

pubspec.yaml

@@ -3,8 +3,13 @@ publish_to: none
 
 # Root of the Formbricks Flutter monorepo.
 # This package is never published; it only declares the pub workspace
-# (Dart 3.6+ / Melos 7) that ties the SDK package and demo app together
-# under a single resolved dependency graph + lockfile.
+# (Melos 8) that ties the SDK package and demo app together under a single
+# resolved dependency graph + lockfile.
+#
+# Working in this repo needs Dart 3.12+ (the `sdk` constraint below). That is
+# stricter than what the pieces themselves require — pub workspaces need
+# Dart 3.6+ and Melos 8.6.0 needs Dart 3.9+ — and stricter than the published
+# `formbricks` package, which keeps a Dart 3.6 / Flutter 3.27 floor.
 environment:
   sdk: ^3.12.0
 
@@ -14,9 +19,9 @@ workspace:
   - apps/playground
 
 dev_dependencies:
-  melos: ^7.8.2
+  melos: ^8.6.0
 
-# Melos 7 builds on Dart's native pub workspaces (the `workspace:` key above).
+# Melos 8 builds on Dart's native pub workspaces (the `workspace:` key above).
 # It adds cross-package scripting: run analyze / test / format across every
 # package with one command. Used locally and in CI.
 melos:
@@ -43,16 +48,18 @@ melos:
 
     test:
       description: Run tests in every package that has a test/ dir.
-      run: flutter test
+      # Melos 8 made `run` and `exec` mutually exclusive — the command an
+      # exec script runs now lives under `exec.command`.
       exec:
+        command: flutter test
         concurrency: 1
       packageFilters:
         dirExists: test
 
     test-coverage:
       description: Run tests with coverage in every package that has tests.
-      run: flutter test --coverage
       exec:
+        command: flutter test --coverage
         concurrency: 1
       packageFilters:
         dirExists: test