chore(deps): update libxmtp to ios-4.11.0-nightly.20260708.4dda49c

[renovate]

This PR contains the following updates:

Package	Update	Change
https://github.com/xmtp/libxmtp	patch	ios-4.11.0-nightly.20260707.e181466 → ios-4.11.0-nightly.20260708.4dda49c

---

Release Notes

xmtp/libxmtp (https://github.com/xmtp/libxmtp)

vios-4.11.0-nightly.20260708.4dda49c: iOS SDK 4.11.0-nightly.20260708.4dda49c

Compare Source

iOS SDK version 4.11.0-nightly.20260708.4dda49c

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

Note

Update libxmtp dependency to ios-4.11.0-nightly.20260708.4dda49c

Bumps the libxmtp package pin in ConvosCore/Package.swift and ConvosInvites/Package.swift from ios-4.11.0-nightly.20260707.e181466 to ios-4.11.0-nightly.20260708.4dda49c. Resolved package state files are updated accordingly.

^{Macroscope summarized 9b672ab.}

[claude]

Claude finished @renovate[bot]'s task —— View job

---

Reviewing PR

Tasks

• Read changed files to understand the dependency update
• Review the version change for potential issues
• Provide comprehensive review feedback

---

Code Review

Summary

This PR updates libxmtp from ios-4.11.0-nightly.20260707.e181466 to ios-4.11.0-nightly.20260708.4dda49c. The change is applied consistently across both package manifests (ConvosCore/Package.swift and ConvosInvites/Package.swift) and their corresponding lock files.

Code Quality ✅

Positive:

• The dependency update is consistent across all affected files
• Package.resolved files are properly updated with the new revision hash
• Version pinning strategy using exact revisions is maintained (good practice for nightly builds)

Potential Issues ⚠️

Nightly Build Stability:

• This is a nightly build (20260708 vs 20260707), which means it's not a stable release
• Nightly builds can introduce breaking changes or regressions without warning
• The change is only one day apart, suggesting this is part of continuous integration

Testing Gap:

• No test coverage changes are included in this PR
• Given that libxmtp is a core dependency used throughout the codebase (ConvosCore and ConvosInvites), this update could affect:
  • XMTP client initialization (ConvosCore/Package.swift:47,85,101)
  • Invite system integration (ConvosInvites/Package.swift:49)
  • Connection layer (ConvosConnectionsXMTP)

Files changed:

• ConvosCore/Package.swift:30 - Revision updated
• ConvosCore/Package.resolved:153-154 - Branch and revision hash updated
• ConvosInvites/Package.swift:29 - Revision updated
• ConvosInvites/Package.resolved - Updated (matching changes)
• Convos.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved - Root project lock file updated

Performance Considerations

• No performance concerns from the dependency update itself
• Impact depends on what changed in the libxmtp library between these two nightly builds

Security Concerns

• Dependency updates can introduce security fixes or vulnerabilities
• Without release notes for this specific nightly build, it's unclear what changed
• The revision hash (36a2e412424a384682cde377a426ecddb0c7adc7) provides immutability and reproducibility

Recommendations

Before merging:

1. Run the full test suite - Especially tests in ConvosCoreTests and ConvosInvitesTests that exercise XMTP functionality
2. Verify build succeeds - Ensure no API breaking changes were introduced
3. Check libxmtp changelog - Review commits between e181466 and 4dda49c in the xmtp/libxmtp repository to understand what changed
4. Manual testing - Test XMTP-dependent features like:
   • Client connection and authentication
   • Message sending/receiving
   • Invite token generation and validation

Process improvement:
Consider adding a step to Renovate's workflow that:

• Links to the upstream changelog/commits
• Requires CI tests to pass before auto-merge
• Flags nightly builds for manual review vs. stable releases

Test Coverage

No new tests are required for this dependency update, but existing tests should be run to verify compatibility.

---

Overall Assessment: This is a routine dependency update with low risk given it's only a one-day increment in the nightly build. However, running tests is critical before merging to catch any regressions introduced by the upstream changes.

---

[macroscopeapp]

Approvability

Verdict: Approved

Automated dependency version bump from Renovate updating libxmtp nightly from 20260707 to 20260708. Changes are limited to package manifest and lock files with no source code modifications.

^{You can customize Macroscope's approvability policy. Learn more.}