Skip to content

flutter_rust_bridge used directly in 4 files but undeclared in pubspec.yaml (pulled in transitively via fula_client) #9

Description

@ehsan6sha

Audit finding: flutter_rust_bridge is imported directly in 4 files but undeclared in pubspec.yaml

flutter analyze reports depend_on_referenced_packages info at:

  • lib/main.dart:6import 'package:flutter_rust_bridge/flutter_rust_bridge_for_generated_io.dart' show ExternalLibrary;
  • lib/sync_background_entrypoint.dart:22 — same import
  • lib/core/services/background_sync_service.dart:7 — same import
  • lib/core/services/auth_service.dart:9 — same import

Current state

pubspec.lock:574-581
  flutter_rust_bridge:
    dependency: transitive   ← pulled in by fula_client, NOT declared by us
    version: "2.12.0"
    sha256: e87d6b9e…a437a

The package is pulled in transitively by fula_client: 0.6.2 (the only direct main dependency that uses flutter_rust_bridge).

Risk

  • No runtime bug today. The transitive resolution gives us flutter_rust_bridge: 2.12.0. All four files compile and work.
  • Fragility. If fula_client ever changes its flutter_rust_bridge constraint (or stops depending on it), our direct uses of ExternalLibrary break. Today the contract is implicit — our code depends on a transitive symbol staying available.
  • Reproducibility. Without a declared constraint, a clean pub get on a different lockfile state could resolve to a different flutter_rust_bridge version that doesn't expose ExternalLibrary at the same import path.

Proposed fix (NOT APPLIED)

Add to pubspec.yaml under dependencies::

flutter_rust_bridge: ^2.12.0   # pinned to the version currently resolved transitively via fula_client

This:

  • Makes the dependency explicit (matches what we already use).
  • Keeps the same version (^2.12.0 allows minor+patch updates within the 2.x major).
  • Costs nothing at runtime (same package, same version, already on disk).

Risk of doing the fix

  • Lockfile churn: pubspec.lock regenerates. If the constraint solver resolves a different version (e.g., fula_client allows ^2.0.0 but the latest is 2.15.0), flutter pub get could upgrade. Mitigation: pin to exact 2.12.0 (drop the ^) if any drift is unacceptable.
  • Build-system tests in test/unit/core/services/upload_queue_lock_test.dart import path_provider_platform_interface and plugin_platform_interface similarly without declaration (lines 182-183 of the analyzer output). Worth doing the same pinning exercise for those in the same PR.

Recommendation

Lowest-risk of the audit findings. Suggest pinning to exact 2.12.0 first to minimise solver drift, observe a flutter pub get outcome, then relax to ^2.12.0 if no surprises. NOT applied per the "100%-sure" rule — even a pubspec change has non-zero risk because the solver re-resolves the full graph.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions