16.7 · Version rules, pins, conflicts, unsafe flags, mirrors and inspecting the graph

Q363 and Q365 introduce the manifest and the managers; this section is what actually happens when the resolver runs: which version it picks, why it keeps it, when two dependencies cannot agree, and what a CI job must do to be repeatable.

Mental model. A manifest states what you will accept; Package.resolved records what you got. Reproducible builds come from honouring the second and understanding the first.

Choosing and holding a version

Version requirements, pins and update, and conflicts.

  1. How do from:, upToNextMinor, exact, ranges and branch requirements differ, and which version does the resolver pick? 16.7.1 · L3
    A requirement is a range over semantic versions, and the resolver picks the highest version that satisfies every requirement in the graph. In the check, a…
  2. What is Package.resolved, when does it change, and how do you make CI resolve exactly what developers tested? 16.7.2 · L3
    Package.resolved records, for each dependency, the exact version and commit revision the resolver chose. Once it exists SwiftPM uses it instead of resolving…
  3. Two dependencies need incompatible versions of a third. What does the resolver say, and how do you get out? 16.7.3 · L5
    SwiftPM has one copy of each package in the graph (it does not nest versions like npm), so every requirement on a package must be satisfiable by a single…

Policy and tooling

What a registry-style dependency may contain, mirrors, and the inspection commands.

  1. Why does SwiftPM refuse a dependency that uses unsafeFlags, and what should you do instead? 16.7.4 · L5
    Escape hatches such as swiftSettings: [.unsafeFlags([…])] (and the cSettings and linkerSettings equivalents) pass arbitrary compiler or linker options. SwiftPM…
  2. How do package mirrors work, and when do you use one for a company or offline CI? 16.7.5 · L5
    A mirror tells SwiftPM “whenever the graph asks for repository X, fetch it from Y instead”. It is configured outside the manifests (swift package config…
  3. How do you inspect a package and its dependency graph from the command line? 16.7.6 · L3
    Three read-only commands answer most “what does this package actually declare?” questions without opening Xcode. swift package describe --type json prints the…

More in Modularization & SPM