Project: Update libraries

[leandroalonso]

Starting in spring 2024, you must include the privacy manifest for any SDK listed below when you submit new apps in App Store Connect that include those SDKs, or when you submit an app update that adds one of the listed SDKs as part of the update. Signatures are also required in these cases where the listed SDKs are used as binary dependencies. Any version of a listed SDK, as well as any SDKs that repackage those on the list, are included in the requirement. — https://developer.apple.com/support/third-party-SDK-requirements/

Dependencies that need privacy manifests

• [x] FMDB #1368
• [x] Lottie #1367
• [x] SwiftyGif #1374
• [x] SwiftyJSON #1376
• [x] Kingfisher (Cocoapods) #1375

Firebase and subdependencies

Firebase has a lot of dependencies that are listed in Apple's article. However, even though Firebase already has an xcprivacy, not all subdependencies have it. This section documents each one.

• [x] Firebase #1584
• [ ] Abseil (xcprivacy file not available)
• [ ] BoringSSL / openssl_grpc (removed with Firebase update)
• [ ] GoogleDataTransport (xcprivacy file not available)
• [ ] GoogleUtilities (xcprivacy file not available)
• [ ] gRPC (xcprivacy file not available)
• [ ] GTMSessionFetcher (xcprivacy file not available, PR draft opened)
• [ ] nanopb (xcprivacy file not available)
• [ ] Promises (xcprivacy file not available, PR opened and approved)
• [ ] leveldb (xcprivacy file not available)

Google Sign in and subdepencencies

• [x] GoogleSignIn #1583
• [ ] AppAuth (xcprivacy file not available)
• [ ] GTMAppAuth (xcprivacy file not available)
• [ ] GTMSessionFetcher (xcprivacy file not available, PR draft opened)
• [ ] GoogleUtilities (xcprivacy file not available)

Dependencies that (in theory) don’t need privacy manifests

(if they repackage any of the SDKs mentioned above they do need a privacy manifest)

• [x] Agrume https://github.com/Automattic/pocket-casts-ios/pull/1374
• [x] AutomattickTracksiOS #1382
• [x] BuildkiteTestCollector
• [x] DifferenceKit
• [x] Fuse
• [x] GoogleAppMeasurement
• [x] Sentry
• [x] Sodium
• [x] SwiftProtobuf
• [x] SwipeCellKit
• [x] UIDeviceIdentifier
• [x] JLRoutes (Cocoapods)
• [x] google-cast-sdk-no-bluetooth (Cocoapods)
• [x] MaterialComponents/BottomSheet (Cocoapods — can be removed once https://github.com/Automattic/pocket-casts-ios/pull/1299 is merged)

Internal Manifests required

• [x] Add Privacy manifest in PodcastsIntents including NSPrivacyAccessedAPICategoryUserDefaults as category
• [x] Add Privacy manifest in WidgetExtension including NSPrivacyAccessedAPICategoryUserDefaults as category
• [x] Add Privacy manifest in Pocket Casts Watch App Extension including NSPrivacyAccessedAPICategoryUserDefaults, NSPrivacyAccessedAPICategoryFileTimestamp as categories
• [x] Add Privacy manifest in podcasts (main app) including NSPrivacyAccessedAPICategoryUserDefaults, NSPrivacyAccessedAPICategoryFileTimestamp, NSPrivacyAccessedAPICategoryDiskSpace as categories

[leandroalonso]

@danielebogo I think this was closed automatically so I'm reopening it given we have two libraries still pending.