Dependency audit + Roxas submodule bump to upstream main#58
Merged
Conversation
Audit (2026-07-03): every MiniStore dependency resolves to SideStore upstream (or the original author) — minimuxer/em_proxy as prebuilt .a from SideStore releases via fetch-prebuilt.sh, AltSign/libimobiledevice family/libplist/ libusbmuxd/Roxas as SideStore submodules, MarkdownAttributedString from chockenberry. No The-Big-Mini fork refs exist anywhere. Documents how to actually upgrade each (submodule pin vs new upstream release) and reiterates the fetch-prebuilt.sh guard against ever pointing minimuxer/em_proxy at a fork. https://claude.ai/code/session_01PT8zpkUrgTRaGeKmbvVyNe
AltSign is already at latest SideStore/AltSign master (a60e8e2e), so the ldid sign-all-binaries work is already present — no bump. MarkdownAttributedString also latest. Roxas is divergent (upstream deleted master; main is an unrelated 180-commit history with an empty merge-base) — do not blind-bump; the pinned SHA is still fetchable so builds are fine. libimobiledevice family + minimuxer + em_proxy are consumed as prebuilt .a (submodule pins cosmetic, minimuxer/em_proxy come from releases/latest). Also documents the git ls-remote https://github.com:443/ trick to read public upstream repos from a repo-scoped session. https://claude.ai/code/session_01PT8zpkUrgTRaGeKmbvVyNe
The-Big-Mini
changed the title
Re-align the Roxas pin onto upstream's maintained branch. SideStore deleted Roxas's master branch and now tracks main; the histories diverged (rewrite), so this moves the pin 0d60d64a -> 0c7d89f6 and points .gitmodules at main. Content delta vs the old pin is trivial and API-identical (MiniStore's RST* usage is unchanged): a LICENSE file, Roxas's own deploy target lowered 15->12 (irrelevant to MiniStore), and a strong-reference fix in RSTLaunchViewController for an iOS 26 crash — a class MiniStore does not use, so it is a harmless carry. Value is housekeeping: future Roxas updates now track main as clean forward-merges instead of a dangling, deleted master. https://claude.ai/code/session_01PT8zpkUrgTRaGeKmbvVyNe
The-Big-Mini
changed the title
Contributor
|
Builds for this Pull Request are available at |
Contributor
|
Download the artifacts for this pull request (nightly.link): |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Audited dependency resolution + submodule pins, and bumped Roxas onto upstream's maintained branch. All deps are upstream (none forked). Findings recorded in
gotchas.md.Changes
SideStore/Roxasmain(0d60d64a→0c7d89f6,.gitmodulesbranch master→main). Upstream deletedmaster;mainis a history-rewrite of the same code. The content delta vs the old pin is trivial and API-identical (MiniStore'sRST*usage unchanged): a LICENSE add, Roxas's own deploy target lowered 15→12 (irrelevant — MiniStore targets iOS 26), and a strong-ref fix inRSTLaunchViewControllerfor an iOS 26 crash (a class MiniStore does not use — harmless carry). Value is housekeeping: future Roxas updates now trackmainas clean forward-merges instead of a dangling deletedmaster.gotchas.md— dependency resolution facts + the submodule bump-audit table + thegit ls-remote https://github.com:443/…trick to read public upstream from a repo-scoped session.Dependency / bump audit (recorded)
.afromSideStore/*releases (fetch-prebuilt.sh); AltSign/libimobiledevice family/libplist/libusbmuxd/Roxas =SideStore/*submodules; MarkdownAttributedString =chockenberry/*. ZeroThe-Big-Minirefs.a60e8e2e) — ldid sign-all-binaries already present. MarkdownAttributedString latest.Type of change
Testing
Build and upload MiniStorebuilds against the bumped Roxas (validates it compiles/links). Roxas'sRST*API is unchanged, so no source changes were needed. Please device-test a normal launch/refresh once (near-zero risk — the only code change is in an unused class).Checklist
developCLAUDE.md🤖 Generated with Claude Code