fix(core): bump Firebase iOS SDK to 12.19.3 (4.x backport, Firestore security fix) (#18861)

* fix(core): bump Firebase iOS SDK to 12.19.3 (CocoaPods and SPM) for Firestore root-certificate security fix

Backport to the 4.x line (BoM 4.20.0). firebase-ios-sdk#16930 removes compromised eMudhra CA roots from Firestore's embedded gRPC root-certificate bundle. Windows (C++ SDK) is covered in a follow-up firebase_core release.

* fix(apple): resolve CocoaPods deps that skip the 12.19.3 patch release

Firebase 12.19.3 only ships Core, Firestore and the umbrella pod. firebase_app_check (iOS) now depends on Firebase/AppCheck like macOS, and firebase_analytics allows any 12.19.x FirebaseAnalytics.

* chore(firestore): drop precompiled Firestore frameworks from 4.x example Podfiles

invertase/firestore-ios-sdk-frameworks has no 12.19.3 tag, so pod install failed; the examples now use the patched FirebaseFirestore from trunk.

Author: Lyokone

packages/cloud_firestore/cloud_firestore/example/ios/Podfile

@@ -50,8 +50,6 @@ target 'Runner' do
       raise "Error - unable to locate firebase_ios_sdk.rb script in firebase_core, and no FirebaseSDKVersion specified"
     end
   end
-
-  pod 'FirebaseFirestore', :git => 'https://github.com/invertase/firestore-ios-sdk-frameworks.git', :tag => "#{firebase_sdk_version}"
 end
 
 post_install do |installer|

packages/cloud_firestore/cloud_firestore/example/macos/Podfile

@@ -49,8 +49,6 @@ target 'Runner' do
       raise "Error - unable to locate firebase_ios_sdk.rb script in firebase_core, and no FirebaseSDKVersion specified"
     end
   end
-
-  pod 'FirebaseFirestore', :git => 'https://github.com/invertase/firestore-ios-sdk-frameworks.git', :tag => "#{firebase_sdk_version}"
 end
 
 post_install do |installer|

packages/cloud_firestore/cloud_firestore/ios/cloud_firestore/Package.swift

@@ -8,7 +8,7 @@
 import PackageDescription
 
 let libraryVersion = "6.10.0"
-let firebaseSdkVersion: Version = "12.19.0"
+let firebaseSdkVersion: Version = "12.19.3"
 
 let package = Package(
   name: "cloud_firestore",

packages/cloud_firestore/cloud_firestore/macos/cloud_firestore/Package.swift

@@ -8,7 +8,7 @@
 import PackageDescription
 
 let libraryVersion = "6.10.0"
-let firebaseSdkVersion: Version = "12.19.0"
+let firebaseSdkVersion: Version = "12.19.3"
 
 let package = Package(
   name: "cloud_firestore",

packages/cloud_functions/cloud_functions/ios/cloud_functions/Package.swift

@@ -7,7 +7,7 @@
 
 import PackageDescription
 
-let firebaseSdkVersion: Version = "12.19.0"
+let firebaseSdkVersion: Version = "12.19.3"
 
 let package = Package(
   name: "cloud_functions",

packages/cloud_functions/cloud_functions/macos/cloud_functions/Package.swift

@@ -7,7 +7,7 @@
 
 import PackageDescription
 
-let firebaseSdkVersion: Version = "12.19.0"
+let firebaseSdkVersion: Version = "12.19.3"
 
 let package = Package(
   name: "cloud_functions",

packages/firebase_analytics/firebase_analytics/ios/firebase_analytics.podspec

@@ -38,7 +38,8 @@ Pod::Spec.new do |s|
   s.swift_version = '5.0'
 
   s.dependency 'firebase_core'
-  s.dependency firebase_analytics, firebase_sdk_version
+  # FirebaseAnalytics is not released with every Firebase patch version (e.g. 12.19.3), so allow any patch of the minor.
+  s.dependency firebase_analytics, "~> #{firebase_sdk_version.sub(/\.\d+$/, '.0')}"
 
   s.static_framework = true
   s.pod_target_xcconfig = {

packages/firebase_analytics/firebase_analytics/ios/firebase_analytics/Package.swift

@@ -8,7 +8,7 @@
 import Foundation
 import PackageDescription
 
-let firebaseSdkVersion: Version = "12.19.0"
+let firebaseSdkVersion: Version = "12.19.3"
 
 // Set FIREBASE_ANALYTICS_WITHOUT_ADID=true to use FirebaseAnalyticsCore.
 // e.g. FIREBASE_ANALYTICS_WITHOUT_ADID=true flutter build ios

packages/firebase_analytics/firebase_analytics/macos/firebase_analytics.podspec

@@ -59,7 +59,8 @@ Pod::Spec.new do |s|
 
   # Firebase dependencies
   s.dependency 'firebase_core'
-  s.dependency firebase_analytics, firebase_sdk_version
+  # FirebaseAnalytics is not released with every Firebase patch version (e.g. 12.19.3), so allow any patch of the minor.
+  s.dependency firebase_analytics, "~> #{firebase_sdk_version.sub(/\.\d+$/, '.0')}"
 
   s.static_framework = true
   s.pod_target_xcconfig = {

packages/firebase_analytics/firebase_analytics/macos/firebase_analytics/Package.swift

@@ -7,7 +7,7 @@
 
 import PackageDescription
 
-let firebaseSdkVersion: Version = "12.19.0"
+let firebaseSdkVersion: Version = "12.19.3"
 
 let package = Package(
   name: "firebase_analytics",