Port forcedotcom#4096: bump SQLCipher 4.16.0 -> 4.17.0 (unit 42/49)

Semantic re-implementation FROM forcedotcom/dev 303013d INTO the ObjC->Swift
migration branch. Dependency version bump; PRE-APPROVED gate (still PR-flagged).

SQLCipher 4.16.0 -> 4.17.0 (bundled SQLite 3.53.1 -> 3.53.3 at runtime) across
the four dependency-declaration sites:
- SmartStore.podspec (CocoaPods dependency)
- mobilesdk_pods.rb (consuming-app Podfile helper)
- SmartStore.xcodeproj + MobileSyncExplorer.xcodeproj SPM exactVersion pins

Version-assertion tests updated in the compiled Swift twin
SFSmartStoreTests.swift (testSqliteVersion 3.53.3, testSqlCipherVersion
4.17.0 community); de-referenced ObjC SFSmartStoreTests.m ref-synced verbatim.
update-sqlcipher SKILL.md synced byte-identical to upstream (typo + template
placeholder).

SmartStore and MobileSync (top of the dependency chain) TEST BUILD SUCCEEDED;
3 version tests pass (runtime-confirmed 4.17.0 community / SQLite 3.53.3).
Marker advanced 41->42 (303013d).

Escalation: SQLCipher dependency bump -- flag in PR (pre-approved).

Author: JohnsonEricAtSalesforce

.claude/pr-escalation-digest.md

@@ -240,8 +240,23 @@ Pre-approved gates (still PR-flag, do NOT re-ask): SQLCipher #4096; Localizable.
   MobileSync build green (0 new warnings in diff); 19 SDKCore tests pass (10 validation + 9 recovery). Escalation =
   login-UI + login-host failure-recovery behavior + L10n — flag in PR.
 
+### Unit 42 · #4096 — SQLCipher 4.16.0 → 4.17.0 (dependency bump, gate PRE-APPROVED)
+**Escalation class: dependency version bump (SQLCipher / SmartStore encryption stack).** Gate was PRE-APPROVED
+(Feedback #4) — no re-ask — but per policy every SQLCipher/dependency change is flagged for PR review.
+**What changed:** SQLCipher `4.16.0 → 4.17.0` (bundled SQLite `3.53.1 → 3.53.3` at runtime), a mechanical version bump
+across the four dependency-declaration sites — `SmartStore.podspec` (CocoaPods), `mobilesdk_pods.rb` (consuming-app
+Podfile helper), and the two SPM `XCRemoteSwiftPackageReference` pins (`SmartStore.xcodeproj`, `MobileSyncExplorer.xcodeproj`,
+`kind = exactVersion`) — plus the version-assertion tests and the maintenance skill doc.
+**Reviewer notes:** (1) No API changes in the SQLCipher 4.17 bump for our usage — SmartStore + MobileSync (top of the
+dependency chain) both build clean and the SQLCipher-linked encryption path is unchanged. (2) The version assertions live
+in the **compiled Swift twin** `SFSmartStoreTests.swift` (`testSqliteVersion` → `3.53.3`, `testSqlCipherVersion` →
+`4.17.0 community`); the de-referenced ObjC `SFSmartStoreTests.m` (0-in-Sources) was ref-synced verbatim for clean future
+merges. (3) `SKILL.md` update is byte-identical to upstream (`SQLLite`→`SQLite` typo + a template-placeholder assertion).
+(4) The version swap required a one-time full DerivedData Build-dir wipe (stale precompiled `sqlite3.h` module) — a local
+build-cache artifact, not a code issue. SmartStore/MobileSync TEST BUILD green; 3 version tests pass (runtime-confirmed
+`4.17.0 community` / SQLite `3.53.3`). **Escalation = SQLCipher dependency bump — flag in PR (pre-approved).**
+
 ## Pending escalation units (upcoming — port in order)
-- **42 · #4096 — dependency bump (gate PRE-APPROVED):** SQLCipher 4.16 → 4.17 (SmartStore.podspec, mobilesdk_pods.rb).
 - **43 · #4098 — OAuth/scene:** nil-sceneId crash fix on advanced-auth browser callback.
 - **44 · #4087 — OAuth/token (LIVE-AUTH UNBLOCKER):** token-refresh coordinator; 18 files. Unblocks Phase 2.
 - **45 · #4102 — OAuth/token:** improve token-refresh error handling.

.claude/skills/update-sqlcipher/SKILL.md

@@ -94,10 +94,10 @@ Update the cipher provider version test:
 
 Note: The OpenSSL version format is typically like "OpenSSL 3.0.17 1 Jul 2025" and the LibTomCrypt format is like "1.18.2" - check the actual runtime value or SQLCipher release notes.
 
-Update the SQLLite version test:
+Update the SQLite version test:
 - (void) testSqliteVersion {
     NSString* version = [NSString stringWithUTF8String:sqlite3_libversion()];
-    XCTAssertEqualObjects(version, @"3.50.4");
+    XCTAssertEqualObjects(version, @"NEW_SQLITE_VERSION");
 }
 
 ### 4. Check for API Changes

.claude/upstream-sync-backlog.md

@@ -1,6 +1,6 @@
 # Upstream Sync Backlog Ledger
 
-Marker (done floor): `e4bdf6397` (units 1-41 done)  ·  forcedotcom/dev HEAD (target): `b5d37d807`  ·  **8 units remaining**  ·  Re-seeded: 2026-07-19 (Phase 0 of the resume-porting plan).
+Marker (done floor): `303013dd7` (units 1-42 done)  ·  forcedotcom/dev HEAD (target): `b5d37d807`  ·  **7 units remaining**  ·  Re-seeded: 2026-07-19 (Phase 0 of the resume-porting plan).
 
 > **Direction:** we port changes **FROM** `forcedotcom/dev` **INTO** our ObjC→Swift migration branch
 > (`feature/objc-to-swift-test-migration`). Each unit is a *semantic re-implementation* against the current
@@ -17,7 +17,7 @@ Marker (done floor): `e4bdf6397` (units 1-41 done)  ·  forcedotcom/dev HEAD (ta
 > non-libs (CI, docs, skills, sample apps). Live progress bar = subject of lead task #9.
 
 ## Migration status
-▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓░░░  41/49 units done (84%)   ·   libs-production-impacting: 15/21   ·   Phase 1 porting (units 1-41 ✅)
+▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓░░░  42/49 units done (86%)   ·   libs-production-impacting: 15/21   ·   Phase 1 porting (units 1-42 ✅)
 
 | Bucket | Count | Notes |
 |--------|-------|-------|
@@ -72,7 +72,7 @@ Marker (done floor): `e4bdf6397` (units 1-41 done)  ·  forcedotcom/dev HEAD (ta
 | 39 | #4093 make advanced-auth default + deprecate forceAdvancedAuthentication | a2c4ee4d5 | B | ⚠⚠⚠ PUBLIC API + advanced-auth + L10n(pre-appr) | ✅ ported fa450e82ca3e45d29c4411f573c59ff20f44a61b | Advanced Auth is now the DEFAULT; `SalesforceManager.forceAdvancedAuthentication` deprecated (14.0→remove 15.0). Ported into compiled Swift twins: **SalesforceSDKManager.swift** (deprecated `@objc` prop backed by non-deprecated `forceAdvancedAuthenticationInternal` = default `true`, mirrors the migration's `showAuthWindowWhileLoading` precedent & upstream's `sdk_forceAdvancedAuthentication`; devActions host-list-as-login-screen routing; devInfo line), **SFOAuthCoordinator.swift** (OR force flag into native-browser decision), **SFSDKLoginHostListViewController.swift** (`presentedAsLoginScreen` + forced-adv-auth chrome: back button/gear via `shouldShowBackButton`/`createBackButton`/`handleBackButtonAction`/`loginOptionsButton`, mirrors SFLoginViewController.swift; `delegateDidChangeLoginOptions`), **SFUserAccountManager.swift** (`presentedAsLoginScreen=true` on cancel-browser host list + new `hostListViewControllerDidChangeLoginOptions`), **AuthFlowTypesView.swift** (force-adv toggle via `forceAdvancedAuthenticationInternal`, warning-free). Compiled header **SFSDKLoginHostDelegate.h** overwritten verbatim (real protocol, matched pre-image → adds optional method). L10n `LOGIN_OPTIONS_FORCE_ADVANCED_AUTH` (pre-approved). De-ref ref-sync: `SFSDKLoginHostListViewController.m` verbatim (matched pre-image); `SalesforceSDKManager.m` + `SFOAuthCoordinator.m` surgical (import + accessor + init default + isShowingLogin + decision + devInfo). Tombstone/stub SKIPS (no compiled region, documented): `SalesforceSDKManager.h`, `SalesforceSDKManager+Internal.h`, `SFSDKLoginHostListViewController.h`, `SFUserAccountManager.m` (79-line stub). Tests: 2 ObjC test files (`SFSDKLoginHostTests.m`/`SalesforceSDKManagerTests.m`) ported to their Swift twins (15 chrome tests + 8 forced-adv-auth incl. capturing-coordinator subclass over now-`internal` `beginNativeBrowserFlow`/`beginWebViewFlow`/`approvalURL`/`brandedAuthorizeURL`, PKCE security-invariant); 3 SDKCore Swift test files hunked (JSON round-trip, session recreate, discovery-gate) — all deprecated-touching helpers `@available(*,deprecated)`-guarded → 0 deprecation warnings. 8 AuthFlowTester UI-test files verbatim + NEW `ForceAdvancedAuthTests.swift` (filesystem-synced group, no pbxproj wiring; build gated on CocoaPods, like #4092). SDKCore/SmartStore/MobileSync TEST BUILD ✓ (0 errors, 0 new warnings in diff); 135 tests across the 5 SDKCore classes PASS (incl. 25 new). ⚠⚠⚠ escalation: PUBLIC-API deprecation + advanced-auth default behavior flip + login-UI + L10n — flag in PR. |
 | 40 | #4088 invalid login-host recovery | a2a271cca | B | ⚠ login-host + L10n(pre-appr) | ✅ ported 6263a436e4127e450592d5be35410ecbce8d9f53 | Validate login-host input; recover to previous host when the current one fails. Ported into compiled Swift twins: **NewLoginHostView.swift** (per-field inline error UI: `NewLoginHostField.errorMessage`/`errorAccessibilityID`; `save(...)` validates non-empty + contains `.` + no whitespace + parseable `https://` URL, sets `hostError`=`LOGIN_INVALID_HOST` and bails on invalid; `.onChange(of: host)` clears error) — twin diverged from pre-image only in 2 `init` API-parity lines (outside change regions) so applied hunks surgically. **SFUserAccountManager.swift** (new `internal var previousLoginHost`; set in `hostListViewController(_:didChange:)`; recovery rewrite in `hostConnectionErrorHandlerBlock` completion: only auto-remove a *deletable* failing host on a **strong-bad-host** signal [`kSFOAuthErrorInvalidURL` / `NSURLErrorBadURL`/`UnsupportedURL`/`AppTransportSecurityRequiresSecureConnection`], NOT on ambiguous DNS/timeout [captive-portal safety]; recovery host = `previousLoginHost` if still in storage else `loginHost(at:0)` guarded by `numberOfLoginHosts>0` to avoid range trap on empty storage). L10n `LOGIN_INVALID_HOST` (pre-approved). Test-visibility: relaxed `SFSDKLoginHostStorage.loginHostList` `private`→`internal` (mirrors ObjC test's KVC reach into the private ivar; no new public API). De-ref ref-sync: `SFUserAccountManager+Internal.h` — added `previousLoginHost` @property to the `#if !defined(SWIFT_CLASS)` ObjC class-extension region verbatim (anchor `nativeLoginEnabled`→`setCurrentUserInternal` matched pre-image; header has NO compiled consumer — all 7 importer `.m` de-referenced — but kept in sync for clean future merges). Stub SKIP (no matching region): `SFUserAccountManager.m` (79-line stub). Tests: NEW ObjC `SFUserAccountManagerLoginHostRecoveryTests.m` (357 lines, `method_exchangeImplementations` swizzle + KVC) ported to a **Swift twin** `SFUserAccountManagerLoginHostRecoveryTests.swift` (9 tests: previousLoginHost capture, restore-to-previous, index-0 fallback ×2, strong-signal removal, ambiguous/DNS keep, empty-storage guard, non-deletable keep) — swizzles `restartAuthentication:` via `method_exchangeImplementations` (mirrors `SFSDKLogoutBlocker.swift`), snapshots the now-`internal` `loginHostList` for the empty-storage case, and attaches the running app's `UIScene` to the request (the migrated `showErrorAlert` skips presentation on nil scene, unlike upstream ObjC — this is why the first test run timed out; fix = set `request.scene`); wired into pbxproj as **Swift** (2 fresh IDs `E40A1C01/02…`), NOT ObjC. `NewLoginHostTests.swift` +6 validation tests (verbatim, matched pre-image). SDKCore/SmartStore/MobileSync TEST BUILD ✓ (0 errors, 0 new warnings in diff); 19 SDKCore tests PASS (10 NewLoginHost + 9 recovery, fixture-based/not live-gated). ⚠ escalation: login-UI + login-host recovery behavior + L10n — flag in PR. |
 | 41 | #4095 token-exchange error tests | e4bdf6397 | A | — | ✅ ported fd0fde64acb2d2a1ba828deffa7262a5449facfd | OAuth2 token-endpoint error classification tests. NEW **SFSDKOAuth2TokenExchangeErrorTests.swift** (7 tests: invalid_grant family ×3 descriptions, invalid_client_id, invalid_client, unsupported_grant_type, invalid_request, enum-mapping lock-in for the 5 wire values, success-response control) ported byte-faithful except two migration adaptations forced by the unit-38 Swift port: (1) `SFSDKOAuthTokenEndpointErrorResponse.errorCode` is the **typed `SFOAuthErrorCode` enum** in the Swift twin (was `NSInteger` in ObjC), so the assertion compares enum-to-enum (`expectedEnum`) instead of `expectedEnum.rawValue`; (2) the Swift `SFSDKOAuthTokenEndpointResponse(dictionary:parseAdditionalFields:)` init is **non-failable** and takes **`NSDictionary`** (was an implicitly-optional ObjC init), so call sites bind directly (no `guard let`) with `let params: NSDictionary`. Wired into SDKCore-test pbxproj as Swift (2 fresh IDs `E40A1C03/04…`). Test-only, SDKCore-scoped — no production change. SDKCore TEST BUILD ✓ (0 errors, 0 new warnings); 7 tests PASS. No escalation. |
-| 42 | #4096 SQLCipher 4.17.0 | 303013dd7 | C | ⚠⚠ dependency bump (PRE-APPROVED gate) | ⬜ pending | `SmartStore.podspec`, `mobilesdk_pods.rb`, SmartStore pbxproj, MobileSyncExplorer pbxproj, `SFSmartStoreTests.m`, skill. SQLCipher 4.16→4.17. Gate PRE-APPROVED (Feedback #4). |
+| 42 | #4096 SQLCipher 4.17.0 | 303013dd7 | C | ⚠⚠ dependency bump (PRE-APPROVED gate) | ✅ ported 2e54cc1c8d37293aa0514f9d9fda7fd101e06df8 | SQLCipher **4.16.0 → 4.17.0** (SQLite 3.53.1 → **3.53.3** runtime). Mechanical version bump across 7 files: **SmartStore.podspec** (`smartstore.dependency 'SQLCipher', '~> 4.17.0'`), **mobilesdk_pods.rb** (`pod 'SQLCipher', '4.17.0'`), **SmartStore pbxproj** + **MobileSyncExplorer pbxproj** (SPM `XCRemoteSwiftPackageReference` exactVersion `4.17.0`, tab-indented, single occurrence each, `plutil` clean), **SFSmartStoreTests.swift** (the COMPILED twin — `testSqliteVersion` `3.53.3`, `testSqlCipherVersion` `4.17.0 community`) + de-ref **SFSmartStoreTests.m** ref-synced verbatim (`.m` is 0-in-Sources; `.swift` twin at pbxproj line 856 is compiled), **`.claude/skills/update-sqlcipher/SKILL.md`** (byte-identical to upstream post-image `79b7335f`: `SQLLite`→`SQLite` typo + example-placeholder assert → `NEW_SQLITE_VERSION`). SPM resolved+checked-out 4.17.0; a stale precompiled-module cache (`sqlite3.h` changed under the version swap) forced a **full Build-dir wipe** (SourcePackages retained) — clean rebuild GREEN. SmartStore + MobileSync (top-of-chain) TEST BUILD ✓ 0 errors; 3 version tests PASS (runtime confirmed `4.17.0 community` / SQLite `3.53.3`). ⚠⚠ dependency bump — PRE-APPROVED (Feedback #4), still flag in PR. |
 | 43 | #4098 fix nil-sceneId crash on advanced-auth browser callback | e4e838863 | B | ⚠ OAuth/scene | ⬜ pending | `SFOAuthCoordinator+Internal.h/.m`, `SFSDKAuthSession.m` + test. |
 | 44 | #4087 token refresh coordinator | 6e0967833 | B+D | ⚠⚠⚠ OAuth/token (LIVE-AUTH UNBLOCKER) | ⬜ pending | 18 files: NEW `SFSDKTokenRefreshCoordinator.h/.m`, `SFOAuthErrorCode.swift`(via #4094), `SFOAuthSessionRefresher.*`, `SFIdentityCoordinator.m`, `SFRestAPI.m`, `UserAccountManager.swift`, `SFSDKOAuth2.m` + tests. **THIS unblocks the 51 SKIP-gated live-org tests → enables Phase 2.** |
 | 45 | #4102 improve token-refresh error handling | 19d4436ab | B | ⚠ OAuth/token | ⬜ pending | `SFRestAPI.m`, `SFSDKOAuth2.h/.m` + tests + pbxproj. |

.claude/upstream-sync-marker

@@ -1 +1 @@
-e4bdf6397b09a00fbe30a50a76d0f804e50f0455
+303013dd7d3a05234559947ab188c6647c26c296

SmartStore.podspec

@@ -21,7 +21,7 @@ Pod::Spec.new do |s|
 
       smartstore.dependency 'SalesforceSDKCore', "~>#{s.version}"
       smartstore.dependency 'FMDB/SQLCipher', '~> 2.7.12'
-      smartstore.dependency 'SQLCipher', '~> 4.16.0'
+      smartstore.dependency 'SQLCipher', '~> 4.17.0'
       smartstore.source_files = 'libs/SmartStore/SmartStore/Classes/**/*.swift', 'libs/SmartStore/SmartStore/SmartStore.h'
       smartstore.public_header_files = 'libs/SmartStore/SmartStore/SmartStore.h'
       smartstore.exclude_files = 'libs/SmartStore/SmartStore/Classes/**/*.{h,m}'

libs/SmartStore/SmartStore.xcodeproj/project.pbxproj

@@ -1291,7 +1291,7 @@
 			repositoryURL = "https://github.com/sqlcipher/SQLCipher.swift";
 			requirement = {
 				kind = exactVersion;
-				version = 4.16.0;
+				version = 4.17.0;
 			};
 		};
 /* End XCRemoteSwiftPackageReference section */

libs/SmartStore/SmartStoreTests/SFSmartStoreTests.m

@@ -103,13 +103,13 @@ - (void) testRuntimeSettings
 - (void) testSqliteVersion
 {
     NSString* version = [NSString stringWithUTF8String:sqlite3_libversion()];
-    XCTAssertEqualObjects(version, @"3.53.1");
+    XCTAssertEqualObjects(version, @"3.53.3");
 }
 
 - (void) testSqlCipherVersion
 {
     NSString* version = [self.store getSQLCipherVersion];
-    XCTAssertEqualObjects(version, @"4.16.0 community");
+    XCTAssertEqualObjects(version, @"4.17.0 community");
 }
 
 - (void) testCipherProviderVersion

libs/SmartStore/SmartStoreTests/SFSmartStoreTests.swift

@@ -93,13 +93,13 @@ class SFSmartStoreTests: SFSmartStoreTestCase {
 
     func testSqliteVersion() {
         let version = String(cString: sqlite3_libversion())
-        XCTAssertEqual(version, "3.53.1")
+        XCTAssertEqual(version, "3.53.3")
     }
 
     func testSqlCipherVersion() {
         guard let store = store else { return XCTFail("Store should not be nil") }
         let version = store.versionOfSQLCipher()
-        XCTAssertEqual(version, "4.16.0 community")
+        XCTAssertEqual(version, "4.17.0 community")
     }
 
     func testCipherProviderVersion() {

mobilesdk_pods.rb

@@ -25,7 +25,7 @@ def use_mobile_sdk!(options={})
 
   source 'https://www.github.com/forcedotcom/SalesforceMobileSDK-iOS-Specs'
 
-  pod 'SQLCipher', '4.16.0'
+  pod 'SQLCipher', '4.17.0'
   pod 'SalesforceSDKCommon', :path => path
   pod 'SalesforceAnalytics', :path => path
   pod 'SalesforceSDKCore', :path => path

native/SampleApps/MobileSyncExplorer/MobileSyncExplorer.xcodeproj/project.pbxproj

@@ -1220,7 +1220,7 @@
 			repositoryURL = "https://github.com/sqlcipher/SQLCipher.swift";
 			requirement = {
 				kind = exactVersion;
-				version = 4.16.0;
+				version = 4.17.0;
 			};
 		};
 /* End XCRemoteSwiftPackageReference section */