Carthage now elides a certain warning about Swift compiler versions upon truths from three sources:

• Swift compiler version (as queried by local machine’s xcode-select and possible TOOLCHAINS environment variable) being greater than 5.1
• that particular framework’s recorded Swift compiler being greater than 5.1
• that particular framework matching (somewhat) a glob (working from framework-bundle-root–level) of Modules/*swiftmodule*/*.swiftinterface
  • note: only one directory matching Modules/*swiftmodule*/ will continue querying inside of it — with FileManager.default.contentsOfDirectory defining that
  • note: presence of particular architectures (armv7, i386, x86_64, etc.) are not taken into account

Note: As .swiftinterface files emission “currently [as of Swift 5.X] requires library evolution support” — take warning of the Swift Compiler Team’s message that “Library evolution trades off performance for flexibility” and comes with caveats. • :warning: Not every library vendor will desire to enable BUILD_LIBRARY_FOR_DISTRIBUTION in their project’s build settings, or even to field questions on bugs resulting from those adding that scope. Be kind to library vendors that might weigh their potential maintenance/ongoing-qa-debugging work differently then your BUILD_LIBRARY_FOR_DISTRIBUTION desires.

〜 Thanks @DavidBrunow for this feature!

Dynamic Intelligent Platform Parsing

Previously, Carthage would propagate errors upon reading non-compiled-in values from SUPPORTED_PLATFORMS or PLATFORM_NAME.

Carthage 0.35.0 supports SUPPORTED_PLATFORMS or PLATFORM_NAME dynamically with intelligent parsing from xcodebuild -showsdks -json.

Carthage’s --platform argument takes the same input of 2019-era SDKs — however, in alignment with the above: the default (a.k.a. “all”) parameter will allow dynamically-parsed SDKs to propagate.

carthage archive still uses the hardcoded four 2019-era SDKs.

The carthage cleanup command — existing on-master, but unshipped-in-tags — no longer makes sense (when set of SDKs are non-fixed across Xcode versions) and has been removed.

Dynamic Platform Parsing can occur from xcodebuild -showsdks -json with fallbacks to BuildSetting extraction from a Xcode-bundled xcodeproj, and beyond that falling back to hardcoded 2019-era values.

⤵️ Note: the dynamic parsing will omit SDKs — such as DriverKit — where JSON-derived canonicalName and platform do not share a common prefix · DriverKit has an ouptut canonicalName similar to «driverkit.macosx19.0».

Other Breaking Changes

• Track static frameworks in .version files. Thanks @elliottwilliams!
  • Old carthage versions will still behave erroneous — but not propagate errors — after parsing sets of newer .version files output for Swift static frameworks.
  • To guarantee output of newer .version files for affected Swift static frameworks, change Swift versions and rerun Carthage with the --cache-builds flag (even temporarily), or delete .framework bundles for affected Swift static ones and rerun Carthage with the --cache-builds flag.
• For GitHub Release assets, expand permitted MIME types to include application/x-zip-compressed. Thanks @MatkovIvan!
• Reject invalid binary archives containing the same framework multiple times. Thanks @tmspzz!
• For binary-spec-ed dependencies and GitHub Release downloads, copy dSYMs if any architecture matches current binary — also affects CarthageKit consumers. Thanks @hlineholm!
• Conflict less in concurrent strip-framework–dedicated Carthage process invocations via different underlying copying — rather than overwrite straight from process, now temp directory usage prevents conflicts on certain same-file/same-path writes. Thanks @kalkwarf!
• Fallback to dSYM version parsing for more cases before invalidating cached builds. Thanks @kmcbride!
• Add --use-netrc flag under which basic ~/.netrc files facilitate binary-specified framework download authentication. Thanks @mollyIV!

Stability

• Fix various cases of «Segmentation Fault 11». Thanks @taisukeh!
• Extend error messages when reading certain binaries. Thanks @hlineholm!

Security Enhancing Breaking Change

• Prevent directory traversal through additional sanitization of git-specified repository URL components — specifically nul characters (\u{0000}) and periods (\u{0023}). Thanks @manicmaniac!
  • Replacement strings include repeated «Full Width Full Stops» (\u{FF0E}) and replacement ␀ (\u{2400}).
  • URL components not starting with periods (\u{0023}) will not see inserted «Full Width Full Stops» (\u{FF0E}).

Breaking — For Apps Importing Carthage Kit and XCDBLD

Thanks to all Contributors

Thank you to @CosynPa, @sidepelican, @chuganzy, @sstadelman (#2781), @giginet (#2761), @ikesyo (#2886, #2785, #2784), @DavidBrunow (#2966, #2967), @mvalentiner, @gubikmic, @sticksen, @nteissler, @ismetanin, @brandonlee503, @yhkaplan, and @tmspzz for improvements to the codebase, tests, and documentation.