Hiding internal product dependencies from consumers in a Swift package

[SDGGiesbrecht (Jeremy David Giesbrecht)]

Name mangling is not necessary. Such transitive dependencies were never supposed to be importable. It was only possible because of an accident of the layout of SwiftPM’s build directory layout and the absence of a deliberate verification step. The latter is now seeing progress:

How to privatize dependencies in Swift Package Manager?

Update (because readers clicking “like” have pushed this thread back into the recent activity feed): Pull request #3562—which at the moment has passed tests but not yet been merged—aims to throw a warning whenever such an indirect dependency is imported.