bug: SPM identity collision between App Check plugin and firebase-ios-sdk transitive dependency

[ryellman]

Plugin(s)

• Analytics
• App
• App Check
• Authentication
• Crashlytics
• Cloud Firestore
• Cloud Functions
• Cloud Messaging
• Cloud Storage
• Performance
• Remote Config

Version

8.1.0

Platform(s)

• Android
• iOS
• Web

Current behavior

Using @capacitor-firebase/app-check and @capacitor-firebase/authentication together fails to resolve SPM package dependencies on Xcode 26. The two plugins cannot be used simultaneously.
@capacitor-firebase/authentication depends on firebase-ios-sdk, which transitively pulls in github.com/google/app-check. SPM derives the identity app-check from both that remote package and the local @capacitor-firebase/app-check plugin directory. Xcode 26 now treats this as a hard error where previous versions only warned.

Expected behavior

Project builds successfully.

Reproduction

https://github.com/ryellman/capfire-spm-mre

Steps to reproduce

`mkdir capfire-mre && cd capfire-mre
pnpm init
pnpm add @capacitor/core @capacitor/ios
mkdir -p dist && echo "MRE" dist/index.html
pnpm --package=@capacitor/cli dlx cap init CapfireMRE com.mre.capfire --web-dir dist
pnpm --package=@capacitor/cli dlx cap add ios
pnpm add @capacitor-firebase/app-check @capacitor-firebase/authentication
pnpm --package=@capacitor/cli dlx cap sync ios
pnpm --package=@capacitor/cli dlx cap open ios

Then attempt to build in Xcode (Cmd+B).

SPM resolution fails with:

Conflicting identity for app-check: dependency 'github.com/google/app-check'
and dependency '.../node_modules/@capacitor-firebase/app-check' both point to
the same package identity 'app-check'.

Other information

No response

Capacitor doctor

💊 Capacitor Doctor 💊

Latest Dependencies:

@capacitor/cli: 8.2.0
@capacitor/core: 8.2.0
@capacitor/android: 8.2.0
@capacitor/ios: 8.2.0

Installed Dependencies:

@capacitor/android: not installed
@capacitor/cli: 8.2.0
@capacitor/core: 8.2.0
@capacitor/ios: 8.2.0

[success] iOS looking great! 👌

Before submitting

• I have read and followed the bug report guidelines.
• I have attached links to possibly related issues and discussions.
• I understand that incomplete issues (e.g. without reproduction) are closed.

[robingenz]

Would you be willing to create a PR?

[ryellman]

No problem - I will work on that tonight.

[ryellman]

Hi Rob, I've looked into this further and it doesn't look like there's an easy fix on the plugin side. The issue comes from how the Capacitor CLI generates CapApp-SPM/Package.swift and how SPM determines package identity.
For non-Cordova plugins, the CLI passes the plugin's npm directory path directly into the generated Package.swift:

const relPath = relative(config.ios.nativeXcodeProjDirAbs, plugin.rootPath);
packageSwiftText += `.package(name: "${plugin.ios.name}", path: "${relPath}")`;

This produces something like:

package(name: "CapacitorFirebaseAppCheck", path: "../../../node_modules/.../@capacitor-firebase/app-check")

The problem is that SPM ignores the name parameter for local path packages — it derives identity from the last path component, which is app-check. Meanwhile firebase-ios-sdk transitively depends on github.com/google/app-check.git, which also resolves to identity app-check. That's the collision.

This link has more info on the behavior:
[https://github.com/swiftlang/swift-evolution/blob/main/proposals/0226-package-manager-target-based-dep-resolution.md]

The plugin's Package.swift already does the right thing by declaring name: "CapacitorFirebaseAppCheck", but SPM simply doesn't use it. And we can't rename the directory since npm controls that based on the package name.
The fix would need to go in @capacitor/cli — for example, creating symlinks with unique names so SPM derives distinct identities.

Let me know if you think I'm missing something though.

[robingenz]

I’ll need some time to take a look at it, but feel free to start a discussion in the Capacitor repo. Maybe in the meantime someone from the Capacitor team will have an idea.

[jacobg]

Is this issue related to these?
ionic-team/capacitor#8335
#942

[robingenz]

@jacobg No, unfortunately not.