build(ios): pin SQLCipher and make Swift Package Manager the verified iOS path

.github/workflows/ci.yml

@@ -29,8 +29,10 @@ jobs:
           java-version: ${{ env.JAVA_VERSION }}
       - name: Install dependencies
         run: npm ci
-      - name: Build iOS
+      - name: Build iOS (Swift Package Manager)
         run: npm run verify:ios
+      - name: Lint iOS podspec (CocoaPods compatibility path)
+        run: npm run verify:ios:pod
       - name: Build Android
         run: npm run verify:android
       - name: Build Web

CONTRIBUTING.md

@@ -19,6 +19,12 @@ This guide provides instructions for contributing to this Capacitor plugin.
    brew install swiftlint
    ```
 
+4. On macOS, the iOS side is a Swift package. Open `Package.swift` in Xcode to work on it. There is no CocoaPods workspace to generate first.
+
+   ```shell
+   xed .
+   ```
+
 ### Scripts
 
 #### `npm run build`
@@ -35,6 +41,17 @@ Build and validate the web and native projects.
 
 This is useful to run in CI to verify that the plugin builds for all platforms.
 
+On iOS this is two gates, both of which also run in CI:
+
+- `npm run verify:ios` builds the Swift package, library and test target, for an iOS Simulator destination. This is the maintained iOS path.
+- `npm run verify:ios:pod` runs `pod lib lint` against `CapacitorCommunitySqlite.podspec`, which is the CocoaPods compatibility path kept for existing consumers. See the iOS section of the README for why that path is frozen.
+
+The iOS unit tests are built by `verify:ios` but not run by it, because running them needs a named simulator rather than a generic destination. To run them locally, pick one that exists on your machine:
+
+```shell
+xcodebuild test -scheme CapacitorCommunitySqlite -destination 'platform=iOS Simulator,name=iPhone 17 Pro'
+```
+
 #### `npm run lint` / `npm run fmt`
 
 Check formatting and code quality, autoformat/autofix if possible.

CapacitorCommunitySqlite.podspec

@@ -2,18 +2,28 @@ require 'json'
 
 package = JSON.parse(File.read(File.join(__dir__, 'package.json')))
 
+# package.json carries the npm form of the repository URL, `git+https://...`. CocoaPods parses
+# this as a `git+https` scheme and warns that GitHub sources should use an `https` link.
+repository_url = package['repository']['url'].sub(%r{\Agit\+}, '')
+
 Pod::Spec.new do |s|
   s.name = 'CapacitorCommunitySqlite'
   s.version = package['version']
   s.summary = package['description']
   s.license = package['license']
-  s.homepage = package['repository']['url']
+  s.homepage = repository_url
   s.author = package['author']
-  s.source = { :git => package['repository']['url'], :tag => s.version.to_s }
+  s.source = { :git => repository_url, :tag => s.version.to_s }
   s.source_files = 'ios/Plugin/**/*.{swift,h,m,c,cc,mm,cpp}'
   s.ios.deployment_target = '15.0'
   s.dependency 'Capacitor'
-  s.dependency 'SQLCipher'
+  # SQLCipher 4.11.0 removed CocoaPods support ("Removes CocoaPods support
+  # (SQLCipher.podspec.json)" in its CHANGELOG), so 4.10.0 is the last version published to
+  # the CocoaPods trunk and this pod can never advance past it. Pinned rather than left open
+  # so CocoaPods resolution is deterministic and the ceiling is visible. Swift Package Manager
+  # (Package.swift) carries the current SQLCipher and is the path that stays in step with
+  # Android; see the iOS section of the README.
+  s.dependency 'SQLCipher', '4.10.0'
   s.dependency 'ZIPFoundation'
   s.swift_version = '5.1'
 end

Package.swift

@@ -11,7 +11,7 @@ let package = Package(
     ],
     dependencies: [
         .package(url: "https://github.com/ionic-team/capacitor-swift-pm.git", branch: "8.0.0"),
-        .package(url: "https://github.com/sqlcipher/SQLCipher.swift.git", from: "4.14.0"),
+        .package(url: "https://github.com/sqlcipher/SQLCipher.swift.git", exact: "4.17.0"),
         .package(url: "https://github.com/weichsel/ZIPFoundation.git", from: "0.9.0")
     ],
     targets: [

README.md

@@ -50,6 +50,8 @@ pnpm install --save sql.js
 npx cap sync
 ```
 
+On iOS the plugin supports both Swift Package Manager and CocoaPods, and the two link different `SQLCipher` versions. See [IOS Quirks](#ios-quirks) before you create the iOS project.
+
 then add plugin to main `capacitor.config.ts` file:
 
 ```ts
@@ -212,6 +214,34 @@ npm install --save-dev electron-builder@24.6.4
 
 - on iOS, no further steps needed.
 
+### Dependency manager: Swift Package Manager or CocoaPods
+
+The iOS side of this plugin ships both a Swift package (`Package.swift`) and a CocoaPods podspec (`CapacitorCommunitySqlite.podspec`). Capacitor picks one when the iOS project is created, and that choice decides which `SQLCipher` build your app links, and therefore which SQLite version it runs.
+
+**Swift Package Manager (recommended).** This is what `npx cap add ios` uses by default in Capacitor 8, and it is the path this repository builds in CI.
+
+```
+npx cap add ios
+```
+
+It resolves `SQLCipher` through [SQLCipher.swift](https://github.com/sqlcipher/SQLCipher.swift), pinned to 4.17.0, whose SQLite baseline is 3.53.3. That is the same SQLCipher release the Android side uses (`net.zetetic:sqlcipher-android:4.17.0`), so both native platforms stay on one SQLite generation.
+
+**CocoaPods (still supported, but frozen).** Existing projects keep working unchanged, and a new project can still opt in:
+
+```
+npx cap add ios --packagemanager CocoaPods
+```
+
+The podspec pins `SQLCipher` to 4.10.0, whose SQLite baseline is 3.50.4. That pin is a ceiling rather than a preference: SQLCipher 4.11.0 removed CocoaPods support ("Removes CocoaPods support (`SQLCipher.podspec.json`)" in its CHANGELOG, October 2025), so 4.10.0 is the last version published to the CocoaPods trunk and no newer SQLCipher can reach this path.
+
+The practical difference is the SQLite baseline: 3.53.3 on Swift Package Manager against 3.50.4 on CocoaPods. Both are encrypted by SQLCipher and both are supported; only the Swift Package Manager path will keep moving.
+
+To move an existing CocoaPods project across, Capacitor ships an assistant:
+
+```
+npx cap spm-migration-assistant
+```
+
 
 ## Supported Methods by Platform
 
@@ -367,7 +397,7 @@ npm install --save-dev electron-builder@24.6.4
 
 ## Dependencies
 
-The iOS and Android codes are using `SQLCipher` allowing for database encryption.
+The iOS and Android codes are using `SQLCipher` allowing for database encryption. On iOS the version depends on the dependency manager, see [IOS Quirks](#ios-quirks).
 The iOS code is using `ZIPFoundation` for unzipping assets files
 The Electron code is using `better-sqlite3-multiple-ciphers` , `electron-json-storage` and `node-fetch`  from 5.0.4.
 The Web code is using the Stencil component `jeep-sqlite` based on `sql.js`, `localforage`. and `jszip`