chore(deps): refresh flutter lockfiles

[wired-pasteque]

No description provided.

[claude]

Claude finished @wired-pasteque's task in 2m 8s —— View job

---

Review: lockfile refresh

• Gather context and read the diff
• Check pubspec.lock changes against pubspec.yaml constraints
• Check ios/Podfile.lock deletions
• Post review summary

Summary: no blocking issues found. All bumps stay within the pubspec.yaml constraints, every package remains hosted on pub.dev with a sha256 pin (no source or URL switches — the main supply-chain check for a lockfile PR), and the SDK pins are unchanged (dart 3.12.2 / flutter 3.44.9). A few items are worth a look before merging:

Note: I can't submit formal inline review comments, so findings are listed here with file references.

⚠️ Worth attention

1. blockchain_utils jumps two major versions: 5.4.0 → 7.1.0 (pubspec.lock:191)
This is the riskiest change in the diff. It's pulled in transitively by the bitcoin_base 7.0.0 → 7.3.0 bump (allowed by the ^7.0.0 constraint at pubspec.yaml:130), but blockchain_utils is the low-level crypto/encoding library underneath bitcoin_base, and a 5.x → 7.x jump is a large behavioral surface for a Bitcoin wallet. Recommend running the address-derivation / PSBT / signing test suites and a send-receive smoke test before merging. bip32_keys 3.1.1 → 3.1.4 (direct dep, key derivation) falls in the same bucket.

2. workmanager_apple pod removed from ios/Podfile.lock (lines 14–15 removed)
workmanager is still a direct dependency (pubspec.yaml:137) and workmanager_apple is still in pubspec.lock (bumped 0.9.1+2 → 0.9.6). The removal is explained by the project's Swift Package Manager integration (ios/Runner.xcodeproj references FlutterGeneratedPluginSwiftPackage): workmanager_apple 0.9.6 supports SPM, so it moved out of CocoaPods. Two things to verify: (a) the iOS build passes on CI and background sync still registers on a device, and (b) everyone regenerating this lockfile has SPM enabled — a machine with SPM disabled will re-add the pod and produce lockfile churn.

3. dbus is downgraded 0.7.14 → 0.7.13 (pubspec.lock:546)
Unusual in a refresh PR — it suggests the lockfile was regenerated under a slightly different resolver state. Linux-only and harmless, but if it wasn't intentional it may flip back on the next refresh.

✔️ Routine

• xml 6.6.1 → 7.0.1 is a transitive major bump; its consumers declared compatibility, low risk.
• Remaining direct-dep bumps are patch/minor and within constraints: dio 5.10 → 5.11, go_router 17.3 → 17.5, sentry_flutter 9.22 → 9.26, image_picker 1.2.2 → 1.2.3, no_screenshot 1.1 → 1.2, webview_flutter 4.14.0 → 4.14.1, workmanager 0.9.0+3 → 0.9.3, etc.

One caveat: Flutter isn't available on this runner, so I couldn't run flutter pub get to independently verify the resolution — CI should confirm the lockfile is consistent.