Pin payjoin crate to 1.0.0-rc.5 via SatoshiPortal fork - #2506

Claude finished @i5hi's task in 2m 40s —— View job

Review: Pin payjoin crate to 1.0.0-rc.5 via SatoshiPortal fork

• Inspect the pubspec.yaml / pubspec.lock diff
• Verify lockfile consistency and pin immutability
• Check CI cache behavior and other repo references to the payjoin package
• Diff the vendored package against pub.dev payjoin 0.1.2 — blocked (no network access in the review sandbox), see below
• Post review summary

Note: I can't submit formal inline review comments in this environment, so findings are referenced by file/line here instead.

Summary

The change looks correct and follows the repo's established pinned-git pattern. No bugs or regressions found in the diff itself. One supply-chain verification step remains that I couldn't perform, plus one minor operational note.

What checks out:

• Immutable pin (pubspec.yaml:47): the dependency is pinned to a full commit SHA (26595d98…), not the mutable pin/payjoin-0.1.2-rc5 branch name. This is the right call and matches every other SatoshiPortal git dep in the file (flutter_secure_storage, bull_sdk, recoverbull, etc.).
• Lockfile consistency (pubspec.lock:1536-1544): ref and resolved-ref both equal the pinned SHA, source is git, version stays 0.1.2, and the payjoin entry is the only change in the lock — no accidental re-resolution of other packages.
• CI caches self-invalidate: pub and cargo cache keys in .github/actions/flutter-setup/action.yml:39,48 derive from hashFiles('pubspec.lock'), so this change busts them cleanly. The cargo cache's fuzzy restore-keys fallback is harmless here — even if a stale registry containing rc.6 is restored, the exact-pin (and committed Cargo.lock in the vendored package) forces rc.5.
• No stale references elsewhere: nothing in build scripts, Gradle, Podfiles, or CI references the payjoin package's pub-cache path or version, so moving it from hosted to git doesn't break any tooling.
• The explanatory comment in pubspec.yaml:39-43 documenting why and when to revert is appreciated.

⚠️ Please verify: vendored package contents (supply-chain)

The review sandbox has no network access, so I could not independently confirm that commit 26595d98 on SatoshiPortal/payjoin-dart is pub.dev payjoin 0.1.2 plus only the crate pin and Cargo.lock. Since this package handles payjoin send/receive logic for a Bitcoin wallet, a second human reviewer should spot-check it:

# fetch pub.dev 0.1.2 and diff against the pinned commit
curl -sL https://pub.dev/api/archives/payjoin-0.1.2.tar.gz | tar xz -C /tmp/payjoin-pub
git clone https://github.com/SatoshiPortal/payjoin-dart /tmp/payjoin-fork
git -C /tmp/payjoin-fork checkout 26595d9821250bbd88f4e43b97acc85f17a93d71
diff -r /tmp/payjoin-pub /tmp/payjoin-fork  # expect: Cargo.toml pin, Cargo.lock, repo metadata only

Minor: keep the pinned commit reachable

Pub fetches git deps by cloning and checking out the ref, so the commit must stay reachable from a branch or tag on the fork. If pin/payjoin-0.1.2-rc5 is ever force-pushed or deleted, pub get breaks for every fresh checkout. Consider tagging the commit (e.g. payjoin-0.1.2-rc5-pin) so it can't be lost to a branch cleanup. Low urgency — same exposure as the repo's other git deps.

CI

The Analyze and Test run for this PR was still in progress at review time — worth confirming the Android job goes green before merging, since that's the failure this fixes.