From 402bd1897f8b7a822819e13fe8afa20037dd1865 Mon Sep 17 00:00:00 2001 From: Tom Brow Date: Mon, 9 Nov 2026 15:23:06 -0800 Subject: [PATCH] fix(mobile): bump Flutter to 3.47.9 for Android TLS fix (#9309) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Flutter 3.47.7's bundled Dart TLS verifier on Android misses Android's compromised-intermediate blocklist and, on Android 14+, reads the older CA directory ([GHSA-frr6-h895-5pxp](https://github.com/dart-lang/sdk/security/advisories/GHSA-frr6-h895-5pxp)). An on-path attacker can therefore impersonate the relay to Android builds with a certificate chained to the compromised eMudhra intermediates. Flutter 3.47.8+ ships the patched verifier. This bumps the hermit pin to the latest patch, 3.47.9 (Dart 3.13.7), and raises the SDK floor in `pubspec.yaml` and CONTRIBUTING to match. Tracked in BSEC-29. iOS and macOS use Apple's certificate verification and aren't affected by this advisory. Patch-level bump within 3.47: no source, formatter or dependency changes were needed; `pubspec.lock` only changes the Flutter floor. No visible change, so no screenshots. ### Validation - `flutter analyze`: no issues. `dart format`: no changes. - Full mobile suite on 3.47.9: 4,596 passed, 67 skipped. - Not done: an Android device run that repeats the eMudhra interception test against a 3.47.9 build. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Tom Brow Co-authored-by: Tom Brow --- CONTRIBUTING.md | 2 +- bin/{.flutter-3.47.7.pkg => .flutter-3.47.9.pkg} | 0 bin/dart | 2 +- bin/flutter | 2 +- mobile/pubspec.lock | 2 +- mobile/pubspec.yaml | 2 +- 6 files changed, 5 insertions(+), 5 deletions(-) rename bin/{.flutter-3.47.7.pkg => .flutter-3.47.9.pkg} (100%) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 404c8532a7..c7c79cf5ba 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -83,7 +83,7 @@ We review as capacity allows — focused PRs that follow this guide move fastest | Rust | 1.88+ | Install via [rustup](https://rustup.rs/) | | Node.js | 24+ | Required for desktop app commands and `just ci` | | pnpm | 10+ | Required for desktop app commands and `just ci` | -| Flutter | 3.47.7+ | Required for mobile app — install via [flutter.dev](https://docs.flutter.dev/get-started/install) | +| Flutter | 3.47.9+ | Required for mobile app — install via [flutter.dev](https://docs.flutter.dev/get-started/install) | | Xcode | 27.1 recommended; 26 supported | Required for iOS builds; see [iOS toolchain setup](mobile/README.md#ios-toolchain) | | Docker | 24+ | For Postgres, Redis, MinIO | | `just` | latest | Task runner — `cargo install just` | diff --git a/bin/.flutter-3.47.7.pkg b/bin/.flutter-3.47.9.pkg similarity index 100% rename from bin/.flutter-3.47.7.pkg rename to bin/.flutter-3.47.9.pkg diff --git a/bin/dart b/bin/dart index 28f286c9c6..bac562fb5a 120000 --- a/bin/dart +++ b/bin/dart @@ -1 +1 @@ -.flutter-3.47.7.pkg \ No newline at end of file +.flutter-3.47.9.pkg \ No newline at end of file diff --git a/bin/flutter b/bin/flutter index 28f286c9c6..bac562fb5a 120000 --- a/bin/flutter +++ b/bin/flutter @@ -1 +1 @@ -.flutter-3.47.7.pkg \ No newline at end of file +.flutter-3.47.9.pkg \ No newline at end of file diff --git a/mobile/pubspec.lock b/mobile/pubspec.lock index a3a747f4cd..bd2f85667d 100644 --- a/mobile/pubspec.lock +++ b/mobile/pubspec.lock @@ -1814,4 +1814,4 @@ packages: version: "2.2.4" sdks: dart: ">=3.11.4 <4.0.0" - flutter: ">=3.47.7" + flutter: ">=3.47.9" diff --git a/mobile/pubspec.yaml b/mobile/pubspec.yaml index 02e4763216..ad01cef42b 100644 --- a/mobile/pubspec.yaml +++ b/mobile/pubspec.yaml @@ -5,7 +5,7 @@ version: 0.0.0+1 environment: sdk: ^3.11.4 - flutter: ">=3.47.7" + flutter: ">=3.47.9" dependencies: flutter: