For most Swift dependencies, use the from requirement. It sets a minimum version and allows updates up to the next major release, which the Swift documentation calls the recommended way. Exact, revision and branch freeze or float versions in ways that hurt either security patching or reproducibility.
The options compared
| Requirement | Range allowed | Documentation guidance |
|---|---|---|
| from (up to next major) | Minimum version up to the next major | Recommended |
| up to next minor | Up to the next minor version | Narrower window of updates |
| exact | One version | Not recommended, can cause graph conflicts |
| range | For example 1.2.3 up to but excluding 1.2.6 | Use for tight control |
| revision | One Git commit | Not recommended, no updates |
| branch | Follows a branch head | For developing packages together or unversioned packages |
Security trade-offs
Ranges let fixes in. A from requirement means a patch release inside the same major version can be picked up when you update. Package.resolved still records the exact version, so builds stay stable until you choose to update.
Exact and revision block fixes. You get no updates. If an advisory is published for that version, you must notice it and edit the manifest. They can also make resolution fail when two packages need different versions of one dependency.
Branch is a moving target. The build can change without a change in your repository. That is hard to review and hard to match to an advisory, since advisories are expressed in versions.
The documentation adds a practical rule: packages that use branch or revision requirements cannot be depended on by packages that use version-based requirements, so you must remove them before publishing a version.
A decision guide
- Default to from with the lowest version you tested.
- Use exact or a tight range only with a written reason, and review it when the dependency gets an advisory.
- Use revision only for a short-term pin to a fix that has no release yet, and plan to move to a tagged version.
- Do not use branch in anything you ship.
- Commit Package.resolved for apps.
What a scanner can do
Advisory databases for Swift describe affected versions as Git tags that follow semantic versioning, and the package name is a Git URL. A dependency on a branch or revision has no clean version for a scanner to match, so treat those as manual review items.
Quick check
Is exact the safest requirement?
It is the most predictable, but the Swift docs do not recommend it. You will not receive fixes unless you edit the manifest, and it can create conflicts.
Can I depend on a package that tracks a branch from a library?
The docs say packages with branch or revision requirements cannot be depended on by packages with version-based requirements.
Safeguard's SBOM and dependency scanning lists each component with its resolved version, which is where a branch or revision pin stands out. The free scan shows your current inventory.
Sources
- Swift PackageDescription API: Package Dependency Requirement
- SwiftPM: Resolving and updating dependencies
- OSV schema: ecosystems
Last reviewed: 19 October 2026.
