[Lyokone]

Description

Release for the 4.x line: BoM 4.20.1, a security release for Cloud Firestore on iOS/macOS. It ships #18861, which pins the Firebase iOS SDK to 12.19.3 for CocoaPods and SPM. That SDK removes compromised eMudhra CA roots from Firestore's embedded gRPC root-certificate bundle (firebase/firebase-ios-sdk#16930).

Generated with melos version + melos bom 4.20.1 from release/4.x at ff334ac.

Packages (all patch bumps, none of these versions are on pub.dev yet)

Package	Version
firebase_core	4.15.1
cloud_firestore	6.10.1
cloud_functions	6.5.1
firebase_analytics	12.6.1
firebase_app_check	0.4.9
firebase_app_installations	0.4.5
firebase_auth	6.7.1
firebase_crashlytics	5.4.1
firebase_database	12.6.1
firebase_in_app_messaging	0.9.5
firebase_messaging	16.7.1
firebase_ml_model_downloader	0.4.6
firebase_performance	0.11.7
firebase_remote_config	6.7.1
firebase_storage	13.6.1

Manual edits on top of melos output

• The 14 bumped plugins require firebase_core: ^4.15.1 (melos left ^4.14.0). Without it, a plugin can resolve against firebase_core 4.15.0. CocoaPods would then quietly stay on 12.19.0, because podspecs read the SDK version from firebase_core. SPM would fail to resolve, because the two packages pin firebase-ios-sdk to different exact versions. smartDependents: false was not used: on this line it bumps 19 platform-interface/web packages to versions already published from the 5.x line.
• Security note added to firebase_core 4.15.1 and the root CHANGELOG.md: SPM users must upgrade; the CocoaPods $FirebaseSDKVersion = '12.19.3' workaround (with an app_check/analytics caveat); Windows is covered in a follow-up release.

Release notes for maintainers

• Merge with "Rebase and merge" (or a merge commit), not squash, so the release commits and the prepared tags stay identical, as in previous 4.x releases.
• Publish only the 15 packages above. melos publish compares local versions with pub.dev's latest (now 5.x), so unscoped it would also try to publish 28 already-published 4.x versions. Use melos publish --no-dry-run with a --scope=<package> for each package above. A scoped dry run passes for all 15: 0 warnings, and the only hint is "earlier than the latest published version".
• Push only the 16 release tags (the 15 package tags + BoM-v4.20.1), not git push --tags.

Follow-ups

• Forward-port the 4.20.1 entries to main's scripts/versions.json and VERSIONS.md: flutterfire install reads versions from main, and the changelog links point there.
• Precompiled Firestore frameworks (invertase/firestore-ios-sdk-frameworks): a 12.19.3 build is in progress. Once it is tagged, the 4.x Firestore example Podfiles can go back to using it.

Breaking Change

• No, this is not a breaking change.

[gemini-code-assist]

Code Review

This pull request introduces a security release (Flutter BoM 4.20.1) that bumps the Firebase iOS SDK to version 12.19.3 across all FlutterFire plugins (including cloud_firestore, firebase_core, firebase_auth, and others) to address a Firestore security vulnerability on iOS and macOS. It updates the corresponding package versions, changelogs, Swift package manifests, and metadata files. I have no feedback to provide as the changes are correct and complete.