[ChiragAgg5k]

Why

Closes the open Dependabot alerts in the Swift example Package.resolved files and mock-server/composer.lock, and fixes the Python template so the generated SDK stops shipping a vulnerable black pin.

Swift examples. Both Package.resolved files were years stale (swift-nio 2.38 / 2.63, while Package.swift.twig now requires from: "2.102.0"). I generated the Apple SDK with php example.php apple, deleted the old pins, ran xcodebuild -resolvePackageDependencies on example-uikit/UIKitExample.xcodeproj and example-swiftui/Example.xcodeproj, and copied the fresh files back. Xcode 27 writes the version 3 format, and every pin carries the upstream tag commit SHA.

Mock server. mongodb/mongodb 1.10.0 (GHSA-8fxw-fmj8-xp7j, GHSA-65fr-j4p9-vc33) was pinned exactly by utopia-php/mongo 0.3.1 through utopia-php/database 0.48, so no lockfile refresh could fix it. utopia-php/database ^5.3 is the newest line that still works with PHP 8.4 (the mock server image) and does not need utopia-php/framework beyond 0.33. Its utopia-php/mongo 1.5.4 no longer depends on mongodb/mongodb at all. The mock server only uses Document and ID from it, and both behave the same. google/protobuf (GHSA-p2gh-cfq4-4wjc) moves along with it. utopia-php/framework stays at 0.33.34 on purpose: 0.33.38 renamed Utopia\App to Utopia\Http, which breaks app/http.php.

Python template. templates/python/pyproject.toml.twig pinned black==25.11.0 (GHSA-3936-cmfr-pm3m). The fix only exists in black 26, which requires Python 3.10, so the pin is black==26.10.1; python_version >= '3.10' and pip install .[test] keeps working on 3.9. 26.10.1 matches the version this repository's validation workflow already uses. appwrite/sdk-for-python#167 makes the same change in the generated repository.

Package	Manifest	Old	New
swift-nio	example-uikit / example-swiftui	2.38.0 / 2.63.0	2.104.0
swift-nio-extras	example-uikit / example-swiftui	1.10.0 / 1.21.0	1.35.1
swift-nio-http2	example-uikit / example-swiftui	1.20.0 / 1.30.0	1.46.0
async-http-client	example-uikit / example-swiftui	1.9.0 / 1.20.1	1.36.2
firebase-ios-sdk	example-swiftui	10.21.0	10.29.0
utopia-php/database	mock-server	0.48.4	5.3.14
utopia-php/mongo	mock-server	0.3.1	1.5.4
mongodb/mongodb	mock-server	1.10.0	removed
google/protobuf	mock-server	4.33.2	5.36.2
black	templates/python/pyproject.toml.twig	25.11.0	26.10.1 (Python 3.10+)

Verification

• composer audit in mock-server: no security vulnerability advisories
• docker compose build && docker compose up in mock-server: mockapi and mqtt start ("Server started successfully")
• vendor/bin/phpunit tests/e2e/Python312Test.php: OK (1 test, 207 assertions), which runs the generated Python SDK against the rebuilt mock server
• vendor/bin/phpunit --testsuite Generation: OK (167 tests, 4 skipped)
• xcodebuild -resolvePackageDependencies on both example projects: resolves cleanly

Related: appwrite-labs/cloud#6671

[hansi-codes]

🟢 Tier S · Ready to merge

The dependency updates are consistent with their manifests and the existing Python compatibility target, and no concrete regression was found.

Updates the Swift example package resolutions, refreshes the mock server's Composer dependencies to the newer database line, and bumps the generated Python test extra's Black pin with a Python version marker. The dependency lockfiles now capture the refreshed package versions.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 5

File	Change
mock-server/composer.json	Moves the mock server's database dependency constraint to the 5.3 line.
mock-server/composer.lock	Locks the refreshed Composer dependency graph, including removal of the old mongodb/mongodb dependency.
templates/python/pyproject.toml.twig	Pins Black 26.10.1 for test installs on Python 3.10 and newer.
templates/swift/example-swiftui/Example.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved	Refreshes the SwiftUI example's Swift Package Manager resolutions.
templates/swift/example-uikit/UIKitExample.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved	Refreshes the UIKit example's Swift Package Manager resolutions.

---

_{Reviewed 213a343 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary