What does ~> mean in a Podfile, and are git sources safe?

In a Podfile, ~> means "this version or newer, up to but not including the next step". So '~> 0.1.2' allows 0.1.2 up to, but not including, 0.2. A :git source without a tag, branch or commit follows the master branch, which is much looser and harder to audit.

The version operators

The CocoaPods Podfile guide lists the forms you can use for a pod version:

Notice that the number of digits you write changes the window. ~> 0.1 is far wider than ~> 0.1.2. Many teams assume the same width in both cases.

Git sources

You can point a pod at a repository with :git, and optionally add :branch, :tag or :commit. Per the guide, without one of these the master branch is used. The podspec must sit in the repository root, unless you use another approach.

From a security view:

• A tag is a label the maintainer can move. A commit hash cannot be moved.
• A branch changes with every push.
• The master default means a fresh install can differ from last week's with no version change at all.

How to keep it reviewable

1. Prefer a pinned version or a narrow ~> with three digits for routine dependencies.
2. When you need :git, use :commit and add a comment saying why and who owns removing it.
3. Never leave a :git line with no reference.
4. Commit Podfile.lock so the resolved result is recorded.
5. Search your Podfile for :git in every release review.
6. Read pod install vs pod update so you know when ranges actually move.

Try it yourself

Click through it at your own pace, or open it full screen. Check how a version number and its source are shown for each package.

Safeguard builds an SBOM and scans your dependencies for known vulnerabilities, and you can run a free scan at gold.safeguard.sh/scan to see what your own project pulls in.

Quick check

Sources

• CocoaPods guide: the Podfile

Last reviewed: 19 October 2026.