pubspec.yaml

# Copyright (c) 2026 Florian DITTGEN
# SPDX-License-Identifier: MIT

name: tankstellen
description: "Free fuel price comparison app — 17 countries, 23 languages, privacy-first"
publish_to: 'none'
version: 6.0.5+5138

environment:
  sdk: ^3.11.3

dependencies:
  flutter:
    sdk: flutter
  flutter_localizations:
    sdk: flutter

  # State Management
  # Both held: riverpod_annotation 4.0.3 pins riverpod 3.3.2, which
  # riverpod_lint 3.1.3 (pinning riverpod 3.2.1) forbids — the whole
  # riverpod/analyzer cluster bumps together once riverpod_lint can move
  # (blocked on the Flutter SDK's meta pin, see riverpod_lint below).
  flutter_riverpod: ^3.0.3
  riverpod_annotation: ^4.0.2

  # Networking
  dio: ^5.11.0

  # Local Storage
  hive: ^2.2.3
  hive_flutter: ^1.1.0

  # Maps & Location
  flutter_map: ^8.3.1
  flutter_map_marker_cluster: ^8.2.2
  # Pinned to 0.x — latlong2 0.10.x is a breaking API bump used
  # pervasively by the map + routing layer. Bump under its own
  # migration pass, not as routine drift (#1684).
  latlong2: ^0.9.1
  geolocator: ^14.0.3
  geocoding: ^5.0.0
  # IMU sensor fusion for dongle-optional driving analytics (#2760).
  # Pure-platform accelerometer + gyroscope (Android SensorManager /
  # iOS CoreMotion) — no GMS / Play Services dependency, so it ships on
  # the F-Droid flavour unchanged (ADR 0003). Only imported by
  # lib/core/sensors/imu_sensor_source.dart (loosely-coupled plugin idiom).
  sensors_plus: ^7.1.0

  # Routing
  go_router: ^17.5.0

  # UI
  flex_color_scheme: ^8.1.0
  intl: ^0.20.2
  qr_flutter: ^4.1.0
  mobile_scanner: ^7.4.0
  # FOSS QR/barcode scanner (FFI to libzxing) — the GMS-free replacement for
  # mobile_scanner's ML Kit backend on the libre/F-Droid build (#3477, epic
  # #3473). Present in every flavor; the QR screen selects it only when
  # AppFlavor.isLibre (Play/iOS keep mobile_scanner). On libre, mobile_scanner
  # is swapped for a no-op stub so its com.google.mlkit refs leave the dex.
  flutter_zxing: ^2.3.0
  image_picker: ^1.2.3
  # Live camera preview for the pump-display capture reticle (#1868).
  # image_picker delegates to the OS camera app, which cannot host an
  # overlay; the camera plugin gives an in-app CameraPreview to draw on.
  camera: ^0.12.0
  # Constraint tracks the vendored third_party/ fork (see
  # dependency_overrides below), which is 0.15.1 — bump both together.
  google_mlkit_text_recognition: ^0.15.1
  image: ^4.9.1
  # Disk-cached, decode-at-size network images — brand logos (#1761).
  cached_network_image: ^3.4.1

  # Data Classes
  freezed_annotation: ^3.0.0
  # Held at 4.11: json_serializable 6.13.x (held below, analyzer cluster)
  # requires json_annotation <4.12.0.
  json_annotation: ^4.11.0

  # Utilities
  collection: ^1.19.0
  meta: ^1.17.0
  xml: ^7.0.1
  path_provider: ^2.1.6
  uuid: ^4.6.0
  # Hold below 7.1.0: connectivity_plus 7.1.x's iOS PathMonitor source
  # references `NWPath.isUltraConstrained`, an iOS 26 SDK symbol guarded by
  # `#available(iOS 26.0, *)`. The runtime guard does NOT save us at compile
  # time — Swift still type-checks the property access against whatever SDK
  # Xcode is using, and the macos-latest GitHub runner has Xcode 16 (iOS 18
  # SDK) which doesn't define `isUltraConstrained`. The build fails with
  # "Value of type 'NWPath' has no member 'isUltraConstrained'". Restore to
  # ^7.1.x once GitHub's macos-* runner image ships Xcode 26+ with the iOS
  # 26 SDK (or once connectivity_plus moves the iOS 26 path behind a Swift
  # `#if canImport(...)` / compiler-version gate).
  connectivity_plus: ^7.3.1
  shared_preferences: ^2.5.5
  url_launcher: ^6.3.1
  http: ^1.3.0
  share_plus: ^13.3.0
  # Inbound OS share-intent receiver (#2735 / Epic #2687) is now served by
  # the in-repo, GMS-free ShareIntentChannel (Android MethodChannel/
  # EventChannel on MainActivity, declared via AndroidManifest intent-filters)
  # — the third-party share_handler plugin was removed so the F-Droid build
  # carries no extra share dependency that could drag in Play Services. iOS is
  # deferred to #2736.
  # On-device PDF e-receipt rasteriser (#2737 / Epic #2687) — a shared PDF
  # receipt is rendered to a bitmap so it flows through the SAME ML Kit OCR
  # path as image shares. MIT-licensed and GMS-FREE: its Android renderer is
  # the OS-native android.graphics.pdf.PdfRenderer (NOT PdfiumAndroid /
  # AndroidPdfViewer) and iOS uses CGPDFPage — no Play Services / ML Kit, so
  # the fdroid GMS audit stays clean. See receipt_pdf_rasterizer.dart.
  pdfx: ^2.9.2
  # Pinned to 1.x — flutter_blue_plus 2.x is a major BLE-API rewrite,
  # and BLE is core to OBD2 trip recording. The 2.x upgrade is tracked
  # separately as part of #1542; do NOT bump it as routine drift.
  flutter_blue_plus: ^1.35.5
  async: ^2.11.0
  permission_handler: ^12.0.3
  flutter_secure_storage: ^11.0.0
  package_info_plus: ^10.2.1
  sentry_flutter: ^9.27.0
  home_widget: ^0.9.3
  workmanager: ^0.10.7
  shimmer: ^3.0.0
  flutter_tts: ^4.2.0
  flutter_local_notifications: ^22.3.0
  supabase_flutter: ^2.17.2
  wakelock_plus: ^1.7.0
  app_badge_plus: ^1.3.4
  archive: ^4.0.9
  # User-driven .zip picker for the full-backup RESTORE flow (#2571).
  # file_selector over file_picker: no runtime storage permission on
  # Android (it routes through the Storage Access Framework document
  # picker) and a smaller plugin surface; the platform implementations
  # are already in the lock as transitive deps of the image/scanner
  # stack, so this only promotes the umbrella package to a direct dep.
  file_selector: ^1.0.3

  # On-device ML inference (#1117 phase 2 — price prediction).
  # Phase 2 ships only the inference plumbing + interpreter seam; a real
  # `.tflite` artifact + heuristic→TFLite cutover come in a follow-up PR.
  tflite_flutter: ^0.12.1

  # OS-native store-review prompt (#3069) — drives the Play In-App Review
  # API on Android and SKStoreReviewController on iOS. The OS renders the
  # dialog, so there are NO custom strings (zero ARB impact). Its Android
  # side pulls Play Core (com.google.android.play:review), a proprietary
  # group STRIPPED from the fdroid flavor (see android/app/build.gradle.kts
  # gmsExcludeGroups + scripts/audit_no_gms.sh). The service therefore
  # swallows every error so the libre build simply no-ops.
  in_app_review: ^2.0.12

dev_dependencies:
  flutter_test:
    sdk: flutter
  integration_test:
    sdk: flutter
  flutter_lints: ^6.0.0

  # Code Generation
  build_runner: ^2.15.1
  # Stable only — 3.2.6-dev.1 is a prerelease; don't let Dependabot pull it.
  freezed: ^3.2.5
  # Held at 6.13.0: >=6.13.2 needs analyzer >=10, riverpod_lint 3.1.3
  # needs analyzer ^9 — part of the same lock-step cluster as below.
  json_serializable: ^6.13.0
  # Held at 4.0.3: 4.0.4 needs riverpod_analyzer_utils 1.0.0-dev.10 while
  # riverpod_lint 3.1.3 (see below) pins dev.9 — bump the pair together.
  riverpod_generator: ^4.0.3

  # Testing
  mocktail: ^1.0.5
  fake_async: ^1.3.3
  yaml: ^3.1.3
  flutter_launcher_icons: ^0.14.4
  # Required only by the FeedbackTokenSection widget test, which uses
  # `FlutterSecureStoragePlatform.instance` to inject a fake store
  # without going through the platform method channel (#952 phase 3).
  flutter_secure_storage_platform_interface: ^2.0.3
  # Required only by the DrivingStationSheet widget test, which swaps
  # `UrlLauncherPlatform.instance` with a fake to assert the geo: URI
  # the Navigate button emits without going through a real intent.
  # Mixing in MockPlatformInterfaceMixin (from plugin_platform_interface)
  # bypasses the verify-token guard for tests only.
  url_launcher_platform_interface: ^2.3.2
  plugin_platform_interface: ^2.1.8
  # #3159 — Riverpod-specific analyzer rules via the NATIVE analyzer-plugin
  # system (activated in analysis_options.yaml's top-level `plugins:`).
  # Pinned exactly: each riverpod_lint release pins one riverpod version
  # (3.1.3 -> riverpod 3.2.1, the locked one). NOT custom_lint: every
  # custom_lint release requires analyzer <9, riverpod_generator 4.x needs ^9.
  # 3.1.4 needs analyzer ^12 -> meta ^1.18, which flutter_test (Flutter
  # 3.41.9 pins meta 1.17.0) forbids — hold at 3.1.3 until the Flutter
  # SDK ships meta >=1.18.
  riverpod_lint: 3.1.3

# #3172 — iOS ML Kit pod strip. iOS OCR is 100% Apple Vision since #3052,
# but the upstream plugins still linked GoogleMLKit/TextRecognition +
# MLKitVision into every iOS build (tens of MB of IPA for code that never
# runs). These overrides point at VENDORED copies (third_party/) that are
# byte-identical to upstream EXCEPT the iOS plugin platform is removed —
# so the pods (and the GeneratedPluginRegistrant entries) disappear from
# the iOS build while the Android ML Kit OCR engine stays untouched.
# Remove when upstream offers a per-platform opt-out.
dependency_overrides:
  google_mlkit_text_recognition:
    path: third_party/google_mlkit_text_recognition
  google_mlkit_commons:
    path: third_party/google_mlkit_commons

flutter:
  uses-material-design: true
  generate: true

  assets:
    # #1776 — `assets/` is deliberately NOT wildcarded. The launcher-icon
    # source art + Play-Store listing graphics (icon*.png/svg,
    # feature_graphic.png, play_store_icon_512.png — ~1.4 MB) live in
    # assets/ but are build-time only: flutter_launcher_icons and the
    # store-listing tooling read them from the source tree, never via
    # rootBundle. `tanksync_config.json` is the only runtime-loaded file
    # at the assets/ root, so it is listed explicitly.
    - assets/tanksync_config.json
    - assets/models/
    - assets/ocr_config/index.json
    - assets/receipt_overrides/index.json
    - assets/reference_vehicles/vehicles.json
    - assets/schemas/

flutter_launcher_icons:
  # Android icon is hand-tuned (adaptive vector + optimized legacy PNGs)
  # — DO NOT regenerate it from this pipeline. The vector
  # `drawable/ic_launcher_foreground.xml` plus `@color` background is the
  # ONLY shape that renders correctly on Samsung OneUI; PNG foregrounds
  # generated by flutter_launcher_icons render as white-on-transparent
  # (#1516 + #1525 both ate two days of debugging on this). If you really
  # need to update the Android icon, edit the vector in place and the
  # legacy mipmap-*/ic_launcher.png rasters by hand.
  android: false
  ios: true
  image_path: "assets/icon.png"
  # Apple rejects iOS app icons with an alpha channel — flatten transparency
  # onto the brand-green background so the App Store validator accepts the
  # build. The brand asset itself keeps its alpha for non-iOS use.
  remove_alpha_ios: true
  background_color_ios: "#2E7D32"
  web:
    generate: false