mirror of
https://github.com/block/buzz.git
synced 2026-11-10 11:21:05 +00:00
402bd1897f
Flutter 3.47.7's bundled Dart TLS verifier on Android misses Android's compromised-intermediate blocklist and, on Android 14+, reads the older CA directory ([GHSA-frr6-h895-5pxp](https://github.com/dart-lang/sdk/security/advisories/GHSA-frr6-h895-5pxp)). An on-path attacker can therefore impersonate the relay to Android builds with a certificate chained to the compromised eMudhra intermediates. Flutter 3.47.8+ ships the patched verifier. This bumps the hermit pin to the latest patch, 3.47.9 (Dart 3.13.7), and raises the SDK floor in `pubspec.yaml` and CONTRIBUTING to match. Tracked in BSEC-29. iOS and macOS use Apple's certificate verification and aren't affected by this advisory. Patch-level bump within 3.47: no source, formatter or dependency changes were needed; `pubspec.lock` only changes the Flutter floor. No visible change, so no screenshots. ### Validation - `flutter analyze`: no issues. `dart format`: no changes. - Full mobile suite on 3.47.9: 4,596 passed, 67 skipped. - Not done: an Android device run that repeats the eMudhra interception test against a 3.47.9 build. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Tom Brow <tomb@squareup.com> Co-authored-by: Tom Brow <tomb@squareup.com>
104 lines
2.7 KiB
YAML
104 lines
2.7 KiB
YAML
name: buzz
|
|
description: Buzz mobile client
|
|
publish_to: 'none'
|
|
version: 0.0.0+1
|
|
|
|
environment:
|
|
sdk: ^3.11.4
|
|
flutter: ">=3.47.9"
|
|
|
|
dependencies:
|
|
flutter:
|
|
sdk: flutter
|
|
cupertino_icons: ^1.0.8
|
|
# Grapheme-cluster segmentation, for deciding whether a message body is
|
|
# nothing but emoji. Already present transitively via the Flutter SDK;
|
|
# declared here because we import it directly.
|
|
characters: ^1.4.0
|
|
hooks_riverpod: ^3.0.3
|
|
flutter_hooks: ^0.21.3
|
|
http: ^1.4.0
|
|
crypto: ^3.0.7
|
|
flutter_secure_storage: ^10.0.0
|
|
flutter_svg: ^2.2.4
|
|
mobile_scanner: ^7.0.0
|
|
shared_preferences: ^2.5.5
|
|
web_socket_channel: ^3.0.1
|
|
connectivity_plus: ^7.0.0
|
|
nostr: ^2.0.0
|
|
buzz_secp256k1:
|
|
path: packages/buzz_secp256k1
|
|
pointycastle: ^4.0.0
|
|
url_launcher: ^6.3.2
|
|
gpt_markdown: ^1.2.1
|
|
highlight: ^0.7.0
|
|
intl: ^0.20.2
|
|
uuid: ^4.5.1
|
|
file_selector: ^1.1.0
|
|
camera: ^0.12.0+2
|
|
image_picker: ^1.1.2
|
|
image: ^4.8.0
|
|
google_mlkit_selfie_segmentation: ^0.11.0
|
|
photo_manager: ^3.11.0
|
|
video_player: ^2.10.1
|
|
just_audio: ^0.10.6
|
|
record: ^6.2.1
|
|
package_info_plus: ^10.0.0
|
|
app_badge_plus: ^1.2.10
|
|
app_links: ^6.4.0
|
|
scrollable_positioned_list: ^0.3.8
|
|
open_filex: ^4.7.0
|
|
path_provider: ^2.1.6
|
|
share_plus: ^13.3.0
|
|
local_auth: ^3.0.2
|
|
unorm_dart: ^0.3.3
|
|
flutter_cache_manager: ^3.5.0
|
|
file: ^7.0.1
|
|
path: ^1.9.1
|
|
|
|
dev_dependencies:
|
|
leak_tracker: ^11.0.2
|
|
shared_preferences_platform_interface: ^2.4.2
|
|
flutter_test:
|
|
sdk: flutter
|
|
flutter_lints: ^6.0.0
|
|
fake_async: ^1.3.3
|
|
camera_platform_interface: ^2.13.1
|
|
custom_lint: ^0.8.0
|
|
riverpod_lint: ^3.1.0
|
|
mocktail: ^1.0.4
|
|
# Test-only platform interface fakes (depend_on_referenced_packages).
|
|
path_provider_platform_interface: ^2.1.2
|
|
plugin_platform_interface: ^2.1.8
|
|
video_player_platform_interface: ^6.6.0
|
|
|
|
flutter:
|
|
config:
|
|
enable-swift-package-manager: false
|
|
uses-material-design: true
|
|
shaders:
|
|
- shaders/toast_island.frag
|
|
- shaders/onboarding_wordmark.frag
|
|
assets:
|
|
- assets/images/welcome-bee.svg
|
|
- assets/images/buzz-icon.png
|
|
- assets/images/shell-gradient.png
|
|
- assets/images/buzz-wordmark.png
|
|
# Generated by `just mobile-emoji-data` from the same emoji-mart dataset
|
|
# desktop uses. Do not hand-edit.
|
|
- assets/emoji/emoji-data.json
|
|
fonts:
|
|
- family: BuzzTabler
|
|
fonts:
|
|
- asset: assets/fonts/TablerIcons.ttf
|
|
- family: Inter
|
|
fonts:
|
|
- asset: assets/fonts/InterVariable.ttf
|
|
- asset: assets/fonts/InterVariable-Italic.ttf
|
|
style: italic
|
|
- family: GeistMono
|
|
fonts:
|
|
- asset: assets/fonts/GeistMono-Variable.ttf
|
|
- asset: assets/fonts/GeistMono-Italic-Variable.ttf
|
|
style: italic
|