From 5665ad69989594a3bac5f3165224f66a37fe488f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?lollipopkit=F0=9F=8F=B3=EF=B8=8F=E2=80=8D=E2=9A=A7?=
 =?UTF-8?q?=EF=B8=8F?= <10864310+lollipopkit@users.noreply.github.com>
Date: Sun, 4 Oct 2026 17:36:17 +0800
Subject: [PATCH 1/2] chore: commit package lockfiles; keep the app's lockfile
 in sync with Dependabot

---
 .github/dependabot.yml                        |  11 +
 .github/workflows/xcode-lockfile.yml          |  59 ++++
 .gitignore                                    |   1 -
 .../xcshareddata/swiftpm/Package.resolved     | 284 ++++++++++++++++++
 Makefile                                      |  17 +-
 Packages/MFuseCore/Package.resolved           |  14 +
 Packages/MFuseDropbox/Package.resolved        |  14 +
 Packages/MFuseFTP/Package.resolved            |  69 +++++
 Packages/MFuseGoogleDrive/Package.resolved    |  14 +
 Packages/MFuseNFS/Package.resolved            |  14 +
 Packages/MFuseOneDrive/Package.resolved       |  14 +
 Packages/MFuseS3/Package.resolved             | 248 +++++++++++++++
 Packages/MFuseSFTP/Package.resolved           | 104 +++++++
 Packages/MFuseSMB/Package.resolved            |  23 ++
 Packages/MFuseTestSupport/Package.resolved    |  14 +
 Packages/MFuseWebDAV/Package.resolved         |  14 +
 scripts/release/release-from-git-version.sh   |   2 +
 17 files changed, 913 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/xcode-lockfile.yml
 create mode 100644 MFuse.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
 create mode 100644 Packages/MFuseCore/Package.resolved
 create mode 100644 Packages/MFuseDropbox/Package.resolved
 create mode 100644 Packages/MFuseFTP/Package.resolved
 create mode 100644 Packages/MFuseGoogleDrive/Package.resolved
 create mode 100644 Packages/MFuseNFS/Package.resolved
 create mode 100644 Packages/MFuseOneDrive/Package.resolved
 create mode 100644 Packages/MFuseS3/Package.resolved
 create mode 100644 Packages/MFuseSFTP/Package.resolved
 create mode 100644 Packages/MFuseSMB/Package.resolved
 create mode 100644 Packages/MFuseTestSupport/Package.resolved
 create mode 100644 Packages/MFuseWebDAV/Package.resolved

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8280d66..22aba2d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -27,6 +27,17 @@ updates:
         patterns:
           - "*"
 
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:15"
+      timezone: "Asia/Shanghai"
+    labels:
+      - "dependencies"
+      - "github-actions"
+
   - package-ecosystem: "npm"
     directory: "/website"
     schedule:
diff --git a/.github/workflows/xcode-lockfile.yml b/.github/workflows/xcode-lockfile.yml
new file mode 100644
index 0000000..f418494
--- /dev/null
+++ b/.github/workflows/xcode-lockfile.yml
@@ -0,0 +1,59 @@
+name: Xcode package lockfile
+
+# Xcode builds the app from its own lockfile, which Dependabot does not update. On
+# Dependabot's PRs this moves the app to the newest versions the manifests allow and commits
+# the result; on other PRs it checks that the lockfile still matches the manifests.
+on:
+  pull_request:
+    paths:
+      - "Packages/*/Package.swift"
+      - "Packages/*/Package.resolved"
+      - "project.yml"
+      - "MFuse.xcodeproj/**"
+      - ".github/workflows/xcode-lockfile.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: xcode-lockfile-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+env:
+  LOCKFILE: MFuse.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
+  FROM_DEPENDABOT: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
+
+jobs:
+  lockfile:
+    runs-on: macos-26
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
+
+      - run: xcodebuild -version
+
+      - name: Update the app's packages
+        if: env.FROM_DEPENDABOT == 'true'
+        run: make update-packages
+
+      - name: Commit the lockfile
+        if: env.FROM_DEPENDABOT == 'true'
+        run: |
+          if git diff --quiet -- "$LOCKFILE"; then exit 0; fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -m "chore(deps): sync the app's package lockfile" -- "$LOCKFILE"
+          git push
+
+      - name: Check the lockfile matches the manifests
+        if: env.FROM_DEPENDABOT != 'true'
+        run: |
+          make resolve
+          git diff --exit-code -- "$LOCKFILE" || {
+            echo "::error::$LOCKFILE is out of date; run 'make resolve' and commit it."
+            exit 1
+          }
diff --git a/.gitignore b/.gitignore
index a4ee85a..acf2879 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,7 +13,6 @@ xcuserdata/
 
 # Swift Package Manager
 .swiftpm/
-Package.resolved
 
 # macOS
 .DS_Store
diff --git a/MFuse.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved b/MFuse.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
new file mode 100644
index 0000000..1aa043d
--- /dev/null
+++ b/MFuse.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
@@ -0,0 +1,284 @@
+{
+  "pins" : [
+    {
+      "identity" : "async-http-client",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/swift-server/async-http-client.git",
+      "state" : {
+        "revision" : "3a5b74a58782c3b4c1f0bc75e9b67b10c2494e8f",
+        "version" : "1.33.1"
+      }
+    },
+    {
+      "identity" : "bigint",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/attaswift/BigInt.git",
+      "state" : {
+        "revision" : "e07e00fa1fd435143a2dcf8b7eec9a7710b2fdfe",
+        "version" : "5.7.0"
+      }
+    },
+    {
+      "identity" : "blake3-swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/JoshBashed/blake3-swift.git",
+      "state" : {
+        "revision" : "8f313fd61f38cbb36f2f4438f6ae5ee97c5791e8",
+        "version" : "0.2.2"
+      }
+    },
+    {
+      "identity" : "citadel",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/orlandos-nl/Citadel.git",
+      "state" : {
+        "revision" : "ae8562f895de06ccb86fdb1cbb65fd99c8976e12",
+        "version" : "0.12.1"
+      }
+    },
+    {
+      "identity" : "jmespath.swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/jmespath/jmespath.swift.git",
+      "state" : {
+        "revision" : "3877a5060e85ae33e3b9fe51ab581784f65ec80e",
+        "version" : "1.0.3"
+      }
+    },
+    {
+      "identity" : "smbclient",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/kishikawakatsumi/SMBClient.git",
+      "state" : {
+        "revision" : "e636c2b2458930770932a36d311ec9d478575b90",
+        "version" : "0.3.1"
+      }
+    },
+    {
+      "identity" : "soto",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/soto-project/soto.git",
+      "state" : {
+        "revision" : "f732b562bb5e0202470157a6041aa754229e777e",
+        "version" : "7.14.0"
+      }
+    },
+    {
+      "identity" : "soto-core",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/soto-project/soto-core.git",
+      "state" : {
+        "revision" : "ae265c8819c0067a2b361408ad92fca0fd60d667",
+        "version" : "7.13.0"
+      }
+    },
+    {
+      "identity" : "swift-algorithms",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-algorithms.git",
+      "state" : {
+        "revision" : "87e50f483c54e6efd60e885f7f5aa946cee68023",
+        "version" : "1.2.1"
+      }
+    },
+    {
+      "identity" : "swift-asn1",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-asn1.git",
+      "state" : {
+        "revision" : "eb50cbd14606a9161cbc5d452f18797c90ef0bab",
+        "version" : "1.7.0"
+      }
+    },
+    {
+      "identity" : "swift-async-algorithms",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-async-algorithms.git",
+      "state" : {
+        "revision" : "9d349bcc328ac3c31ce40e746b5882742a0d1272",
+        "version" : "1.1.3"
+      }
+    },
+    {
+      "identity" : "swift-atomics",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-atomics.git",
+      "state" : {
+        "revision" : "b601256eab081c0f92f059e12818ac1d4f178ff7",
+        "version" : "1.3.0"
+      }
+    },
+    {
+      "identity" : "swift-certificates",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-certificates.git",
+      "state" : {
+        "revision" : "5aa1c0d1bc204908df47c2075bdbb39573d05e8d",
+        "version" : "1.19.0"
+      }
+    },
+    {
+      "identity" : "swift-collections",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-collections.git",
+      "state" : {
+        "revision" : "6675bc0ff86e61436e615df6fc5174e043e57924",
+        "version" : "1.4.1"
+      }
+    },
+    {
+      "identity" : "swift-configuration",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-configuration.git",
+      "state" : {
+        "revision" : "be76c4ad929eb6c4bcaf3351799f2adf9e6848a9",
+        "version" : "1.2.0"
+      }
+    },
+    {
+      "identity" : "swift-crypto",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-crypto.git",
+      "state" : {
+        "revision" : "95ba0316a9b733e92bb6b071255ff46263bbe7dc",
+        "version" : "3.15.1"
+      }
+    },
+    {
+      "identity" : "swift-distributed-tracing",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-distributed-tracing.git",
+      "state" : {
+        "revision" : "dc4030184203ffafbb2ec614352487235d747fe0",
+        "version" : "1.4.1"
+      }
+    },
+    {
+      "identity" : "swift-http-structured-headers",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-http-structured-headers.git",
+      "state" : {
+        "revision" : "933538faa42c432d385f02e07df0ace7c5ecfc47",
+        "version" : "1.7.0"
+      }
+    },
+    {
+      "identity" : "swift-http-types",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-http-types.git",
+      "state" : {
+        "revision" : "45eb0224913ea070ec4fba17291b9e7ecf4749ca",
+        "version" : "1.5.1"
+      }
+    },
+    {
+      "identity" : "swift-log",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-log.git",
+      "state" : {
+        "revision" : "5073617dac96330a486245e4c0179cb0a6fd2256",
+        "version" : "1.12.0"
+      }
+    },
+    {
+      "identity" : "swift-metrics",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-metrics.git",
+      "state" : {
+        "revision" : "c6593dac9d65f2517280d88c430dadffdf259737",
+        "version" : "2.10.0"
+      }
+    },
+    {
+      "identity" : "swift-nio",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio.git",
+      "state" : {
+        "revision" : "cd6710454f25733900e133c6caf5188952763c36",
+        "version" : "2.98.0"
+      }
+    },
+    {
+      "identity" : "swift-nio-extras",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio-extras.git",
+      "state" : {
+        "revision" : "5a48717e29f62cb8326d6d42e46b562ca93847a6",
+        "version" : "1.34.0"
+      }
+    },
+    {
+      "identity" : "swift-nio-http2",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio-http2.git",
+      "state" : {
+        "revision" : "81cc18264f92cd307ff98430f89372711d4f6fe9",
+        "version" : "1.43.0"
+      }
+    },
+    {
+      "identity" : "swift-nio-ssh",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/Wellz26/swift-nio-ssh.git",
+      "state" : {
+        "revision" : "a05e6bbe6b141ee68da3030e00275504c0595d4d",
+        "version" : "0.3.6"
+      }
+    },
+    {
+      "identity" : "swift-nio-ssl",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio-ssl.git",
+      "state" : {
+        "revision" : "3f337058ccd7243c4cac7911477d8ad4c598d4da",
+        "version" : "2.37.0"
+      }
+    },
+    {
+      "identity" : "swift-nio-transport-services",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio-transport-services.git",
+      "state" : {
+        "revision" : "9d4e67af1eea85967c7de778ad73e7776e5f1f22",
+        "version" : "1.27.0"
+      }
+    },
+    {
+      "identity" : "swift-numerics",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-numerics.git",
+      "state" : {
+        "revision" : "0c0290ff6b24942dadb83a929ffaaa1481df04a2",
+        "version" : "1.1.1"
+      }
+    },
+    {
+      "identity" : "swift-service-context",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-service-context.git",
+      "state" : {
+        "revision" : "d0997351b0c7779017f88e7a93bc30a1878d7f29",
+        "version" : "1.3.0"
+      }
+    },
+    {
+      "identity" : "swift-service-lifecycle",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/swift-server/swift-service-lifecycle.git",
+      "state" : {
+        "revision" : "9829955b385e5bb88128b73f1b8389e9b9c3191a",
+        "version" : "2.11.0"
+      }
+    },
+    {
+      "identity" : "swift-system",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-system.git",
+      "state" : {
+        "revision" : "7c6ad0fc39d0763e0b699210e4124afd5041c5df",
+        "version" : "1.6.4"
+      }
+    }
+  ],
+  "version" : 2
+}
diff --git a/Makefile b/Makefile
index e546ab2..b0b18d4 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: all build test test-stable test-all generate clean lint debug-install release-install release-dmg sync-homebrew-cask release
+.PHONY: all build test test-stable test-all generate resolve update-packages clean lint debug-install release-install release-dmg sync-homebrew-cask release
 
 SCHEME = MFuse
 APP_NAME = MFuse
@@ -52,6 +52,19 @@ test-all:
 generate:
 	$(XCODEGEN_ENV) xcodegen generate
 
+# The app's package versions are pinned in XCODE_PACKAGE_RESOLVED. Dependabot only updates
+# the lockfiles next to each Package.swift, which Xcode ignores.
+XCODE_PACKAGE_RESOLVED = MFuse.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
+
+# Brings the app's lockfile in line with the manifests, keeping every pin that still fits.
+resolve:
+	xcodebuild -resolvePackageDependencies -project MFuse.xcodeproj -scheme $(SCHEME)
+
+# Moves every app dependency to the newest version its manifest allows.
+update-packages:
+	rm -f $(XCODE_PACKAGE_RESOLVED)
+	$(MAKE) resolve
+
 clean:
 	xcodebuild -scheme $(SCHEME) clean
 	rm -rf DerivedData .build
@@ -72,7 +85,7 @@ debug-install: generate
 # and the Release profiles from project.local.yml, hardened runtime) so problems that only
 # show up in a release build can be reproduced without archiving, notarizing or publishing.
 release-install: generate
-	xcodebuild -scheme $(SCHEME) -configuration Release -derivedDataPath $(RELEASE_INSTALL_DERIVED_DATA) build \
+	xcodebuild -scheme $(SCHEME) -configuration Release -derivedDataPath $(RELEASE_INSTALL_DERIVED_DATA) -onlyUsePackageVersionsFromResolvedFile build \
 		MARKETING_VERSION="$(RELEASE_MARKETING_VERSION)" \
 		CURRENT_PROJECT_VERSION="$(COMMIT_COUNT)" \
 		OTHER_CODE_SIGN_FLAGS="--options runtime"
diff --git a/Packages/MFuseCore/Package.resolved b/Packages/MFuseCore/Package.resolved
new file mode 100644
index 0000000..988dbf1
--- /dev/null
+++ b/Packages/MFuseCore/Package.resolved
@@ -0,0 +1,14 @@
+{
+  "pins" : [
+    {
+      "identity" : "blake3-swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/JoshBashed/blake3-swift.git",
+      "state" : {
+        "revision" : "8f313fd61f38cbb36f2f4438f6ae5ee97c5791e8",
+        "version" : "0.2.2"
+      }
+    }
+  ],
+  "version" : 2
+}
diff --git a/Packages/MFuseDropbox/Package.resolved b/Packages/MFuseDropbox/Package.resolved
new file mode 100644
index 0000000..988dbf1
--- /dev/null
+++ b/Packages/MFuseDropbox/Package.resolved
@@ -0,0 +1,14 @@
+{
+  "pins" : [
+    {
+      "identity" : "blake3-swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/JoshBashed/blake3-swift.git",
+      "state" : {
+        "revision" : "8f313fd61f38cbb36f2f4438f6ae5ee97c5791e8",
+        "version" : "0.2.2"
+      }
+    }
+  ],
+  "version" : 2
+}
diff --git a/Packages/MFuseFTP/Package.resolved b/Packages/MFuseFTP/Package.resolved
new file mode 100644
index 0000000..8d31d99
--- /dev/null
+++ b/Packages/MFuseFTP/Package.resolved
@@ -0,0 +1,69 @@
+{
+  "originHash" : "3ea4759fa95fca0e43677645c147c9fb72c8ab07d78f2b632685b357f175cf3a",
+  "pins" : [
+    {
+      "identity" : "blake3-swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/JoshBashed/blake3-swift.git",
+      "state" : {
+        "revision" : "8f313fd61f38cbb36f2f4438f6ae5ee97c5791e8",
+        "version" : "0.2.2"
+      }
+    },
+    {
+      "identity" : "swift-atomics",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-atomics.git",
+      "state" : {
+        "revision" : "0442cb5a3f98ab802acb777929fdb446bda11a34",
+        "version" : "1.3.1"
+      }
+    },
+    {
+      "identity" : "swift-collections",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-collections.git",
+      "state" : {
+        "revision" : "98ef3c98609a1e31b7e157b5b619579001a789d6",
+        "version" : "1.7.1"
+      }
+    },
+    {
+      "identity" : "swift-nio",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio.git",
+      "state" : {
+        "revision" : "21de5f08c1a166a6dd293d0e587ad977bf8dac5d",
+        "version" : "2.103.0"
+      }
+    },
+    {
+      "identity" : "swift-nio-ssl",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio-ssl.git",
+      "state" : {
+        "revision" : "322f3c2a4a21df31c84ca416bf65ee5e9059e440",
+        "version" : "2.37.5"
+      }
+    },
+    {
+      "identity" : "swift-nio-transport-services",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio-transport-services.git",
+      "state" : {
+        "revision" : "67787bb645a5e67d2edcdfbe48a216cc549222d5",
+        "version" : "1.28.0"
+      }
+    },
+    {
+      "identity" : "swift-system",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-system.git",
+      "state" : {
+        "revision" : "869129b7bf4ecc57b97d0193ad29690ca2134750",
+        "version" : "1.8.1"
+      }
+    }
+  ],
+  "version" : 3
+}
diff --git a/Packages/MFuseGoogleDrive/Package.resolved b/Packages/MFuseGoogleDrive/Package.resolved
new file mode 100644
index 0000000..988dbf1
--- /dev/null
+++ b/Packages/MFuseGoogleDrive/Package.resolved
@@ -0,0 +1,14 @@
+{
+  "pins" : [
+    {
+      "identity" : "blake3-swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/JoshBashed/blake3-swift.git",
+      "state" : {
+        "revision" : "8f313fd61f38cbb36f2f4438f6ae5ee97c5791e8",
+        "version" : "0.2.2"
+      }
+    }
+  ],
+  "version" : 2
+}
diff --git a/Packages/MFuseNFS/Package.resolved b/Packages/MFuseNFS/Package.resolved
new file mode 100644
index 0000000..988dbf1
--- /dev/null
+++ b/Packages/MFuseNFS/Package.resolved
@@ -0,0 +1,14 @@
+{
+  "pins" : [
+    {
+      "identity" : "blake3-swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/JoshBashed/blake3-swift.git",
+      "state" : {
+        "revision" : "8f313fd61f38cbb36f2f4438f6ae5ee97c5791e8",
+        "version" : "0.2.2"
+      }
+    }
+  ],
+  "version" : 2
+}
diff --git a/Packages/MFuseOneDrive/Package.resolved b/Packages/MFuseOneDrive/Package.resolved
new file mode 100644
index 0000000..988dbf1
--- /dev/null
+++ b/Packages/MFuseOneDrive/Package.resolved
@@ -0,0 +1,14 @@
+{
+  "pins" : [
+    {
+      "identity" : "blake3-swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/JoshBashed/blake3-swift.git",
+      "state" : {
+        "revision" : "8f313fd61f38cbb36f2f4438f6ae5ee97c5791e8",
+        "version" : "0.2.2"
+      }
+    }
+  ],
+  "version" : 2
+}
diff --git a/Packages/MFuseS3/Package.resolved b/Packages/MFuseS3/Package.resolved
new file mode 100644
index 0000000..eb7d1f0
--- /dev/null
+++ b/Packages/MFuseS3/Package.resolved
@@ -0,0 +1,248 @@
+{
+  "pins" : [
+    {
+      "identity" : "async-http-client",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/swift-server/async-http-client.git",
+      "state" : {
+        "revision" : "4c005f955e83f888d5616e579717a36d2dfc6301",
+        "version" : "1.36.2"
+      }
+    },
+    {
+      "identity" : "blake3-swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/JoshBashed/blake3-swift.git",
+      "state" : {
+        "revision" : "8f313fd61f38cbb36f2f4438f6ae5ee97c5791e8",
+        "version" : "0.2.2"
+      }
+    },
+    {
+      "identity" : "jmespath.swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/jmespath/jmespath.swift.git",
+      "state" : {
+        "revision" : "3877a5060e85ae33e3b9fe51ab581784f65ec80e",
+        "version" : "1.0.3"
+      }
+    },
+    {
+      "identity" : "soto",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/soto-project/soto.git",
+      "state" : {
+        "revision" : "19c212921c56125ab40ca91213e97890aef8be1b",
+        "version" : "7.17.0"
+      }
+    },
+    {
+      "identity" : "soto-core",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/soto-project/soto-core.git",
+      "state" : {
+        "revision" : "4309f0c0f608b1f4db1d84e5928a925a3894ee91",
+        "version" : "7.17.0"
+      }
+    },
+    {
+      "identity" : "swift-algorithms",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-algorithms.git",
+      "state" : {
+        "revision" : "87e50f483c54e6efd60e885f7f5aa946cee68023",
+        "version" : "1.2.1"
+      }
+    },
+    {
+      "identity" : "swift-asn1",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-asn1.git",
+      "state" : {
+        "revision" : "3b6410f7dee09eb33cdd26260c5fd47fda19b0e2",
+        "version" : "1.7.3"
+      }
+    },
+    {
+      "identity" : "swift-async-algorithms",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-async-algorithms.git",
+      "state" : {
+        "revision" : "13713a4ffdee8abd929f92568ee9462a46ae26e0",
+        "version" : "1.1.7"
+      }
+    },
+    {
+      "identity" : "swift-atomics",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-atomics.git",
+      "state" : {
+        "revision" : "0442cb5a3f98ab802acb777929fdb446bda11a34",
+        "version" : "1.3.1"
+      }
+    },
+    {
+      "identity" : "swift-certificates",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-certificates.git",
+      "state" : {
+        "revision" : "ff86b924ead66f853b8baf91f3c41926a8f36177",
+        "version" : "1.21.0"
+      }
+    },
+    {
+      "identity" : "swift-collections",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-collections.git",
+      "state" : {
+        "revision" : "98ef3c98609a1e31b7e157b5b619579001a789d6",
+        "version" : "1.7.1"
+      }
+    },
+    {
+      "identity" : "swift-configuration",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-configuration.git",
+      "state" : {
+        "revision" : "3533f65d3e36dcdffc91ce34ef4d3c9c1887fd4b",
+        "version" : "1.2.1"
+      }
+    },
+    {
+      "identity" : "swift-crypto",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-crypto.git",
+      "state" : {
+        "revision" : "a9d1d5ab8951ada40cafff8c8e2b551dfde4f390",
+        "version" : "5.0.0"
+      }
+    },
+    {
+      "identity" : "swift-distributed-tracing",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-distributed-tracing.git",
+      "state" : {
+        "revision" : "cc504a45f6ce73ce6067837d7ac19fa67b229a56",
+        "version" : "1.5.0"
+      }
+    },
+    {
+      "identity" : "swift-http-structured-headers",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-http-structured-headers.git",
+      "state" : {
+        "revision" : "933538faa42c432d385f02e07df0ace7c5ecfc47",
+        "version" : "1.7.0"
+      }
+    },
+    {
+      "identity" : "swift-http-types",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-http-types.git",
+      "state" : {
+        "revision" : "bff4b6903cdc99dda49649dd52f46c11cfd3ed50",
+        "version" : "1.8.0"
+      }
+    },
+    {
+      "identity" : "swift-log",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-log.git",
+      "state" : {
+        "revision" : "9c6fb14227f55d8f711ce3847dc2f419fb0ecacb",
+        "version" : "1.15.1"
+      }
+    },
+    {
+      "identity" : "swift-metrics",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-metrics.git",
+      "state" : {
+        "revision" : "087e8074afa97040c3b870c8664fe5482fb87cc4",
+        "version" : "2.11.0"
+      }
+    },
+    {
+      "identity" : "swift-nio",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio.git",
+      "state" : {
+        "revision" : "21de5f08c1a166a6dd293d0e587ad977bf8dac5d",
+        "version" : "2.103.0"
+      }
+    },
+    {
+      "identity" : "swift-nio-extras",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio-extras.git",
+      "state" : {
+        "revision" : "41449336c8ecfadac6b4b5be75f9c3c306e61ced",
+        "version" : "1.35.1"
+      }
+    },
+    {
+      "identity" : "swift-nio-http2",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio-http2.git",
+      "state" : {
+        "revision" : "0f3e54e29c944c2e835ad52159da7d9e1c94ac69",
+        "version" : "1.46.0"
+      }
+    },
+    {
+      "identity" : "swift-nio-ssl",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio-ssl.git",
+      "state" : {
+        "revision" : "322f3c2a4a21df31c84ca416bf65ee5e9059e440",
+        "version" : "2.37.5"
+      }
+    },
+    {
+      "identity" : "swift-nio-transport-services",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio-transport-services.git",
+      "state" : {
+        "revision" : "67787bb645a5e67d2edcdfbe48a216cc549222d5",
+        "version" : "1.28.0"
+      }
+    },
+    {
+      "identity" : "swift-numerics",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-numerics.git",
+      "state" : {
+        "revision" : "0c0290ff6b24942dadb83a929ffaaa1481df04a2",
+        "version" : "1.1.1"
+      }
+    },
+    {
+      "identity" : "swift-service-context",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-service-context.git",
+      "state" : {
+        "revision" : "d0997351b0c7779017f88e7a93bc30a1878d7f29",
+        "version" : "1.3.0"
+      }
+    },
+    {
+      "identity" : "swift-service-lifecycle",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/swift-server/swift-service-lifecycle.git",
+      "state" : {
+        "revision" : "7f9326b0326ff86e3646295ea6e891f68c471c5e",
+        "version" : "2.12.0"
+      }
+    },
+    {
+      "identity" : "swift-system",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-system.git",
+      "state" : {
+        "revision" : "869129b7bf4ecc57b97d0193ad29690ca2134750",
+        "version" : "1.8.1"
+      }
+    }
+  ],
+  "version" : 2
+}
diff --git a/Packages/MFuseSFTP/Package.resolved b/Packages/MFuseSFTP/Package.resolved
new file mode 100644
index 0000000..227cb64
--- /dev/null
+++ b/Packages/MFuseSFTP/Package.resolved
@@ -0,0 +1,104 @@
+{
+  "pins" : [
+    {
+      "identity" : "bigint",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/attaswift/BigInt.git",
+      "state" : {
+        "revision" : "e07e00fa1fd435143a2dcf8b7eec9a7710b2fdfe",
+        "version" : "5.7.0"
+      }
+    },
+    {
+      "identity" : "blake3-swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/JoshBashed/blake3-swift.git",
+      "state" : {
+        "revision" : "8f313fd61f38cbb36f2f4438f6ae5ee97c5791e8",
+        "version" : "0.2.2"
+      }
+    },
+    {
+      "identity" : "citadel",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/orlandos-nl/Citadel.git",
+      "state" : {
+        "revision" : "ae8562f895de06ccb86fdb1cbb65fd99c8976e12",
+        "version" : "0.12.1"
+      }
+    },
+    {
+      "identity" : "swift-asn1",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-asn1.git",
+      "state" : {
+        "revision" : "3b6410f7dee09eb33cdd26260c5fd47fda19b0e2",
+        "version" : "1.7.3"
+      }
+    },
+    {
+      "identity" : "swift-atomics",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-atomics.git",
+      "state" : {
+        "revision" : "0442cb5a3f98ab802acb777929fdb446bda11a34",
+        "version" : "1.3.1"
+      }
+    },
+    {
+      "identity" : "swift-collections",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-collections.git",
+      "state" : {
+        "revision" : "98ef3c98609a1e31b7e157b5b619579001a789d6",
+        "version" : "1.7.1"
+      }
+    },
+    {
+      "identity" : "swift-crypto",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-crypto.git",
+      "state" : {
+        "revision" : "95ba0316a9b733e92bb6b071255ff46263bbe7dc",
+        "version" : "3.15.1"
+      }
+    },
+    {
+      "identity" : "swift-log",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-log.git",
+      "state" : {
+        "revision" : "9c6fb14227f55d8f711ce3847dc2f419fb0ecacb",
+        "version" : "1.15.1"
+      }
+    },
+    {
+      "identity" : "swift-nio",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio.git",
+      "state" : {
+        "revision" : "21de5f08c1a166a6dd293d0e587ad977bf8dac5d",
+        "version" : "2.103.0"
+      }
+    },
+    {
+      "identity" : "swift-nio-ssh",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/Wellz26/swift-nio-ssh.git",
+      "state" : {
+        "revision" : "d88989f3d3bb1dfb2a38ce4af598afbf7fc3095c",
+        "version" : "0.3.7"
+      }
+    },
+    {
+      "identity" : "swift-system",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-system.git",
+      "state" : {
+        "revision" : "869129b7bf4ecc57b97d0193ad29690ca2134750",
+        "version" : "1.8.1"
+      }
+    }
+  ],
+  "version" : 2
+}
diff --git a/Packages/MFuseSMB/Package.resolved b/Packages/MFuseSMB/Package.resolved
new file mode 100644
index 0000000..dc9f393
--- /dev/null
+++ b/Packages/MFuseSMB/Package.resolved
@@ -0,0 +1,23 @@
+{
+  "pins" : [
+    {
+      "identity" : "blake3-swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/JoshBashed/blake3-swift.git",
+      "state" : {
+        "revision" : "8f313fd61f38cbb36f2f4438f6ae5ee97c5791e8",
+        "version" : "0.2.2"
+      }
+    },
+    {
+      "identity" : "smbclient",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/kishikawakatsumi/SMBClient.git",
+      "state" : {
+        "revision" : "e636c2b2458930770932a36d311ec9d478575b90",
+        "version" : "0.3.1"
+      }
+    }
+  ],
+  "version" : 2
+}
diff --git a/Packages/MFuseTestSupport/Package.resolved b/Packages/MFuseTestSupport/Package.resolved
new file mode 100644
index 0000000..988dbf1
--- /dev/null
+++ b/Packages/MFuseTestSupport/Package.resolved
@@ -0,0 +1,14 @@
+{
+  "pins" : [
+    {
+      "identity" : "blake3-swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/JoshBashed/blake3-swift.git",
+      "state" : {
+        "revision" : "8f313fd61f38cbb36f2f4438f6ae5ee97c5791e8",
+        "version" : "0.2.2"
+      }
+    }
+  ],
+  "version" : 2
+}
diff --git a/Packages/MFuseWebDAV/Package.resolved b/Packages/MFuseWebDAV/Package.resolved
new file mode 100644
index 0000000..988dbf1
--- /dev/null
+++ b/Packages/MFuseWebDAV/Package.resolved
@@ -0,0 +1,14 @@
+{
+  "pins" : [
+    {
+      "identity" : "blake3-swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/JoshBashed/blake3-swift.git",
+      "state" : {
+        "revision" : "8f313fd61f38cbb36f2f4438f6ae5ee97c5791e8",
+        "version" : "0.2.2"
+      }
+    }
+  ],
+  "version" : 2
+}
diff --git a/scripts/release/release-from-git-version.sh b/scripts/release/release-from-git-version.sh
index 59b85f9..873aa31 100755
--- a/scripts/release/release-from-git-version.sh
+++ b/scripts/release/release-from-git-version.sh
@@ -165,9 +165,11 @@ rm -f "$EXPORT_OPTIONS_PATH" "$DMG_PATH"
 /usr/libexec/PlistBuddy -c "Add :provisioningProfiles:$APP_BUNDLE_ID string $APP_PROFILE_NAME" "$EXPORT_OPTIONS_PATH"
 /usr/libexec/PlistBuddy -c "Add :provisioningProfiles:$EXTENSION_BUNDLE_ID string $EXTENSION_PROFILE_NAME" "$EXPORT_OPTIONS_PATH"
 
+# Released builds use exactly the package versions in the committed lockfile.
 xcodebuild archive \
   -project "$PROJECT_PATH" \
   -scheme "$SCHEME" \
+  -onlyUsePackageVersionsFromResolvedFile \
   -configuration Release \
   -archivePath "$ARCHIVE_PATH" \
   CODE_SIGN_STYLE=Manual \

From 0c8439105f0115f68213260b8822820e421ebc13 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?lollipopkit=F0=9F=8F=B3=EF=B8=8F=E2=80=8D=E2=9A=A7?=
 =?UTF-8?q?=EF=B8=8F?= <10864310+lollipopkit@users.noreply.github.com>
Date: Sun, 4 Oct 2026 18:21:37 +0800
Subject: [PATCH 2/2] fix: release script refuses to delete /, $HOME or the
 repo; creates output parents

---
 scripts/release/release-from-git-version.sh | 26 ++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/scripts/release/release-from-git-version.sh b/scripts/release/release-from-git-version.sh
index 873aa31..13d1a4c 100755
--- a/scripts/release/release-from-git-version.sh
+++ b/scripts/release/release-from-git-version.sh
@@ -135,7 +135,28 @@ find_profile_name() {
   exit 1
 }
 
-mkdir -p "$ARTIFACTS_PATH" "$(dirname "$ARCHIVE_PATH")"
+# Deletes previous build output. The paths can come from the release environment, so a
+# path that is, or contains, the filesystem root, the home folder or the repository is
+# refused instead of deleted.
+remove_build_output() {
+  local path resolved
+  for path in "$@"; do
+    [[ -e "$path" || -L "$path" ]] || continue
+    if [[ -d "$path" && ! -L "$path" ]]; then
+      resolved="$(cd "$path" && pwd -P)"
+    else
+      resolved="$(cd "$(dirname "$path")" && pwd -P)"
+      resolved="${resolved%/}/$(basename "$path")"
+    fi
+    if [[ "$path" -ef / || "$HOME/" == "$resolved/"* || "$REPO_ROOT/" == "$resolved/"* ]]; then
+      echo "refusing to delete $path: it is or contains /, \$HOME or the repository" >&2
+      exit 1
+    fi
+    rm -rf -- "$path"
+  done
+}
+
+mkdir -p "$ARTIFACTS_PATH" "$(dirname "$ARCHIVE_PATH")" "$(dirname "$EXPORT_OPTIONS_PATH")" "$(dirname "$DMG_PATH")"
 
 if ! security find-identity -v -p codesigning | grep -F "$SIGNING_IDENTITY" >/dev/null; then
   echo "signing identity not found in keychain: $SIGNING_IDENTITY" >&2
@@ -153,8 +174,7 @@ fi
 APP_PROFILE_NAME="${APP_PROFILE_NAME:-$(find_profile_name "$APP_BUNDLE_ID" "$SIGNING_IDENTITY_SHA1")}"
 EXTENSION_PROFILE_NAME="${EXTENSION_PROFILE_NAME:-$(find_profile_name "$EXTENSION_BUNDLE_ID" "$SIGNING_IDENTITY_SHA1")}"
 
-rm -rf "$ARCHIVE_PATH" "$EXPORT_PATH" "$DMG_STAGING_PATH"
-rm -f "$EXPORT_OPTIONS_PATH" "$DMG_PATH"
+remove_build_output "$ARCHIVE_PATH" "$EXPORT_PATH" "$DMG_STAGING_PATH" "$EXPORT_OPTIONS_PATH" "$DMG_PATH"
 /usr/libexec/PlistBuddy -c 'Clear dict' "$EXPORT_OPTIONS_PATH"
 /usr/libexec/PlistBuddy -c 'Add :method string developer-id' "$EXPORT_OPTIONS_PATH"
 /usr/libexec/PlistBuddy -c 'Add :signingStyle string manual' "$EXPORT_OPTIONS_PATH"