fix: [SDK-4496] support Capacitor 8+ in @capacitor/core peer dep

[fadi-george]

Description

One Line Summary

Widen the @capacitor/core peer dependency from ^7.0.0 to >=7.0.0 so the plugin installs cleanly in Capacitor 8 (and future-major) projects without npm i --force.

Details

Motivation

Fixes #14. The current peer dep ^7.0.0 resolves to >=7.0.0 <8.0.0, so npm refuses to install @onesignal/capacitor-plugin in any project using @capacitor/core@8.x:

npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error Found: @capacitor/core@8.3.1
npm error Could not resolve dependency:
npm error peer @capacitor/core@"^7.0.0" from @onesignal/capacitor-plugin@1.0.1

The plugin only imports Plugin (type) and registerPlugin from @capacitor/core, both of which are stable across Cap 7 and Cap 8. Our own demo apps under examples/ already build against @capacitor/core@^8.3.0, confirming runtime compatibility.

Scope

• peerDependencies."@capacitor/core": ^7.0.0 -> >=7.0.0 so end users on any Cap 7+ major can install us.
• devDependencies."@capacitor/core": ^7.0.0 -> 7.0.0 (exact) so our own typecheck/build/tests run against the floor we claim to support. Catches accidental usage of newer-minor APIs at PR time.
• bun.lock regenerated to reflect the new pin.
• No source changes. dist/ output is unaffected; @capacitor/core was already externalized at pack time.

Testing

Unit testing

Existing test suite (177 tests across 11 files, 100% statement/line/function coverage) re-run against the pinned @capacitor/core@7.0.0. All pass.

Manual testing

• vp install resolves cleanly with the new ranges.
• vp check passes (formatting, lint, typecheck) — confirms our imports are valid against the 7.0.0 floor.
• vp test run passes.
• vp pack output still externalizes @capacitor/core (verified in dist/index.js).

Affected code checklist

• Notifications
  • Display
  • Open
  • Push Processing
  • Confirm Deliveries
• Outcomes
• Sessions
• In-App Messaging
• REST API requests
• Public API changes

(No runtime code touched; package metadata only.)

Checklist

Overview

• I have filled out all REQUIRED sections above
• PR does one thing
• Any Public API changes are explained in the PR details and conform to existing APIs

Testing

• I have included test coverage for these changes, or explained why they are not needed
• All automated tests pass, or I explained why that is not possible
• I have personally tested this on my device, or explained why that is not possible

Final pass

• Code is as readable as possible.
• I have reviewed this PR myself, ensuring it meets each checklist item

Made with Cursor

[claude]

LGTM — peer dep widening to support Capacitor 8+, no source changes.

Extended reasoning...

Overview

This PR only modifies package.json and bun.lock to widen the @capacitor/core peer dependency from ^7.0.0 to >=7.0.0 (allowing Capacitor 8+ consumers to install without --force), and pins the dev dependency to exact 7.0.0 so internal typecheck/build runs against the supported floor. No runtime/source code is changed.

Security risks

None. This is a package metadata change only. No code paths, auth, crypto, permissions, or data handling are touched.

Level of scrutiny

Low scrutiny is appropriate. This is a one-line peerDependencies range change with a corresponding lockfile update. I verified that src/ only imports registerPlugin and the Plugin type from @capacitor/core (src/index.ts:1, src/definitions.ts:1) — both are stable across Cap 7 and Cap 8, supporting the author's compatibility claim.

Other factors

The bug hunting system found no issues. The author noted that the existing 177-test suite passes against the pinned floor version and that examples already build against Cap 8.3, providing further confidence.