iOS Privacy Manifests: Firebase Auth 10.25.0 blocks upgrade of GTMSessionFetcher to required 4.0+ version

[Sammy087]

Is there an existing issue for this?

• I have searched the existing issues.

Which plugins are affected?

Core

Which platforms are affected?

iOS

Description

Unable to submit iOS app to App Store due to privacy manifest requirements for GTMSessionFetcher and GoogleToolboxForMac. The current Firebase dependencies prevent updating these SDKs to versions that support privacy manifests.

Current Setup

• Flutter Firebase plugins versions:
  • firebase_core: ^2.27.1
  • firebase_auth: ^4.17.9
  • firebase_storage: ^11.6.10
  • firebase_crashlytics: ^3.4.19
  • firebase_analytics: ^10.8.10
  • cloud_firestore: ^4.15.9

The Problem

1. Apple now requires GTMSessionFetcher and GoogleToolboxForMac to include privacy manifests (ITMS-91061)
2. Privacy manifests are only available in:
   • GTMSessionFetcher >= 4.0.0
   • GoogleToolboxForMac >= 4.0.0
3. However, Firebase Auth 10.25.0 (which is locked by the Flutter plugins) has this dependency:

   GTMSessionFetcher/Core (< 4.0, >= 2.1)
   

4. This creates a circular dependency that prevents updating to versions with privacy manifests.

Error Messages:
[!] CocoaPods could not find compatible versions for pod "GTMSessionFetcher/Core":
In Podfile:
GTMSessionFetcher (= 4.3.0) was resolved to 4.3.0, which depends on
GTMSessionFetcher/Full (= 4.3.0) was resolved to 4.3.0, which depends on
GTMSessionFetcher/Core (= 4.3.0)
firebase_auth (from .symlinks/plugins/firebase_auth/ios) was resolved to 4.20.0, which depends on
Firebase/Auth (= 10.25.0) was resolved to 10.25.0, which depends on
FirebaseAuth (~> 10.25.0) was resolved to 10.25.0, which depends on
GTMSessionFetcher/Core (< 4.0, >= 2.1)

IMpact:
This is blocking iOS app submissions to the App Store for all Flutter Firebase apps that use Firebase Auth, as Apple now requires privacy manifests for these SDKs.

REQUESTING:
Please update the Flutter Firebase plugins to support newer versions of Firebase iOS SDK that are compatible with GTMSessionFetcher 4.0+ and GoogleToolboxForMac 4.0+.

Reproducing the issue

Environment

• Flutter version: [latest]
• Firebase CLI version: [latest]
• Xcode version: [latest]
• iOS deployment target: 16.4
• CocoaPods version: 1.16.2
  Additional Context
  This is a critical issue as Apple's privacy manifest requirements are now enforced for all app submissions.

Firebase Core version

2.27.1

Flutter Version

3.27.2

Relevant Log Output

Key Error/Warning Messages:
)
Environment Information:
iOS deployment target: 16.4
Flutter version: 3.27.2
Dart version: 3.6.1
CocoaPods version: 1.16.2
Dependency Conflict:
The key issue is that Firebase Auth 10.25.0 requires GTMSessionFetcher < 4.0, but Apple's privacy manifest requirements need version 4.0 or later. This creates an unresolvable conflict because:
Firebase Auth 10.25.0 → requires GTMSessionFetcher < 4.0
Apple Privacy Manifests → requires GTMSessionFetcher ≥ 4.0

Flutter dependencies

Dart SDK 3.6.1
Flutter SDK 3.27.2
veltro_app 1.6.2+19

dependencies:

• background_location 0.11.8 [flutter]
• cloud_firestore 4.17.5 [cloud_firestore_platform_interface cloud_firestore_web collection firebase_core firebase_core_platform_interface flutter meta]
• csv 5.1.1
• cupertino_icons 1.0.8
• file_picker 6.2.1 [flutter flutter_web_plugins flutter_plugin_android_lifecycle plugin_platform_interface ffi path win32]
• firebase_analytics 10.10.7 [firebase_analytics_platform_interface firebase_analytics_web firebase_core firebase_core_platform_interface flutter]
• firebase_auth 4.20.0 [firebase_auth_platform_interface firebase_auth_web firebase_core firebase_core_platform_interface flutter meta]
• firebase_core 2.32.0 [firebase_core_platform_interface firebase_core_web flutter meta]
• firebase_crashlytics 3.5.7 [firebase_core firebase_core_platform_interface firebase_crashlytics_platform_interface flutter stack_trace]
• firebase_storage 11.7.7 [firebase_core firebase_core_platform_interface firebase_storage_platform_interface firebase_storage_web flutter]
• fl_chart 0.65.0 [equatable flutter]
• flutter 0.0.0 [characters collection material_color_utilities meta vector_math sky_engine]
• flutter_barometer 0.1.0 [flutter]
• geolocator 10.1.1 [flutter geolocator_platform_interface geolocator_android geolocator_apple geolocator_web geolocator_windows]
• google_mlkit_text_recognition 0.11.0 [flutter google_mlkit_commons]
• grpc 3.2.4 [archive async crypto fixnum googleapis_auth meta http http2 protobuf clock]
• html 0.15.5 [csslib source_span]
• image 4.3.0 [archive meta xml]
• image_picker 1.1.2 [flutter image_picker_android image_picker_for_web image_picker_ios image_picker_linux image_picker_macos image_picker_platform_interface image_picker_windows]
• intl 0.19.0 [clock meta path]
• path_provider 2.1.5 [flutter path_provider_android path_provider_foundation path_provider_linux path_provider_platform_interface path_provider_windows]
• pdf 3.11.1 [archive barcode bidi crypto image meta path_parsing vector_math xml]
• pdf_render 1.4.12 [collection flutter flutter_web_plugins js plugin_platform_interface vector_math]
• pdf_text 0.5.0 [flutter path path_provider http]
• printing 5.13.1 [ffi flutter flutter_web_plugins http image meta pdf pdf_widget_wrapper plugin_platform_interface web]
• protobuf 3.1.0 [collection fixnum meta]
• provider 6.1.2 [collection flutter nested]
• purchases_flutter 6.30.2 [flutter freezed_annotation json_annotation]
• sensors_plus 3.1.0 [flutter flutter_web_plugins sensors_plus_platform_interface]
• share_plus 10.0.0 [cross_file meta mime flutter flutter_web_plugins share_plus_platform_interface file url_launcher_web url_launcher_windows url_launcher_linux url_launcher_platform_interface ffi web win32]
• shared_preferences 2.3.5 [flutter shared_preferences_android shared_preferences_foundation shared_preferences_linux shared_preferences_platform_interface shared_preferences_web shared_preferences_windows]
• signature 5.5.0 [flutter flutter_svg image]
• syncfusion_flutter_pdf 24.2.9 [flutter intl xml syncfusion_flutter_core crypto convert]
• url_launcher 6.3.1 [flutter url_launcher_android url_launcher_ios url_launcher_linux url_launcher_macos url_launcher_platform_interface url_launcher_web url_launcher_windows]

dev dependencies:

• flutter_launcher_icons 0.13.1 [args checked_yaml cli_util image json_annotation path yaml]
• flutter_lints 2.0.3 [lints]
• flutter_test 0.0.0 [flutter test_api matcher path fake_async clock stack_trace vector_math leak_tracker_flutter_testing async boolean_selector characters collection leak_tracker leak_tracker_testing material_color_utilities meta source_span stream_channel string_scanner term_glyph vm_service]

Additional context and comments

please help i've been working on this since the 12th of February I haven't slept

[paulb777]

Privacy manifests were introduced to GTMSessionFetcher in version 3.3.0. See https://github.com/google/gtm-session-fetcher/releases/tag/v3.3.0

[russellwheatley]

@Sammy087 FlutterFire is on firebase-ios-sdk v11.8.0: https://github.com/firebase/flutterfire/blob/main/packages/firebase_core/firebase_core/ios/firebase_sdk_version.rb#L3

This was released yesterday. You're using FlutterFire dependencies nearly a year old.

If you want a really easy way to upgrade all FlutterFire dependencies to latest versions, install the FlutterFire CLI:

dart pub global activate flutterfire_cli

Run:

flutterfire install latest

and it will bump dependencies in your pubspec.yaml and install them.

[Sammy087]

I got this error though? why I cant figure out how to fix it without breaking another dependency:
firebase_storage: Using Firebase SDK version '11.8.0' defined in 'firebase_core'
[!] CocoaPods could not find compatible versions for pod "GTMSessionFetcher/Core":
In Podfile:
GTMSessionFetcher (= 4.3.0) was resolved to 4.3.0, which depends on
GTMSessionFetcher/Full (= 4.3.0) was resolved to 4.3.0, which depends on
GTMSessionFetcher/Core (= 4.3.0)

google_mlkit_text_recognition (from `.symlinks/plugins/google_mlkit_text_recognition/ios`) was resolved to 0.11.0, which depends on
  GoogleMLKit/TextRecognition (~> 4.0.0) was resolved to 4.0.0, which depends on
    MLKitTextRecognition (~> 2.0.0) was resolved to 2.0.0, which depends on
      MLKitVision (~> 5.0) was resolved to 5.0.0, which depends on
        GTMSessionFetcher/Core (< 3.0, >= 1.1)