chore(deps)!: bump dep floors, widen plus-plugin majors, migrate file_picker 11 by xsahil03x · Pull Request #2644 · GetStream/stream-chat-flutter

xsahil03x · 2026-05-12T15:43:07Z

Summary

Three commits cleaning up the dep tree against the v10 floor (Flutter 3.38.1 / Dart 3.10):

Runtime dep floors + plus-plugin major widening + file_picker 11 migration (180f03e86) — closes Unable to use latest Flutter packages alongside stream_chat_flutter #2599 and addresses CVE-2026-34240 in jose.
Dev dependency floors (f5383197d) — raises floors of build/test tooling (build_runner, drift_dev, json_serializable, test, mocktail, etc.) to their current resolved versions.
Codegen regeneration (f10051914) — .g.dart / .freezed.dart files regenerated with the new tool versions.

Breaking change

file_picker is bumped from ^10.1.2 to ^11.0.0. Consumers depending on file_picker directly must also upgrade past 11.0.0, which replaces the instance-based FilePicker.platform.* API with static FilePicker.* methods. Internal callers in stream_chat_flutter have been migrated.

Security

jose floor raised from ^0.3.4 to ^0.3.5+1 to address CVE-2026-34240 (untrusted JWK header accepted during signature verification). The SDK only uses JsonWebToken.unverified so it isn't directly exploitable, but the floor bump ensures consumers resolve to a patched version and SCA scanners stop flagging.

Plus-plugin widenings (issue #2599 family)

Dep	Before	After
`device_info_plus`	`>=11.0.0 <13.0.0`	`>=12.4.0 <14.0.0`
`package_info_plus`	`>=8.3.0 <10.0.0`	`>=9.0.1 <11.0.0`
`share_plus`	`>=11.0.0 <13.0.0`	`>=12.0.2 <14.0.0`

The "breaking" 13.x / 10.x / 13.x releases of these plus_plugins packages were environment-only (win32 6.x + min Flutter/Dart bumps). The 13.1 / 10.1 / 13.1 patches lowered the SDK requirements back down to Flutter 3.38.1 / Dart 3.10 — fully compatible with our floor.

Floor bumps to current resolved versions

Set the minimum constraint of every direct dep in our published packages to the version currently being resolved on our min Flutter (3.38.1). This prevents consumers from being pinned to ancient transitive versions and tightens our guarantees.

freezed_annotation floor intentionally kept at >=2.4.1 <4.0.0 to avoid forcing consumers off freezed 2.x.

Codegen regeneration

The bumped codegen tools (freezed 3.x, json_serializable 6.13.x, drift_dev 2.33) produce different output:

json_serializable switched to Dart's null-aware map entry syntax ('key': ?nullableExpr) — same JSON wire format, verified empirically.
freezed — cosmetic formatting differences only.
drift_dev 2.33 — heavy line-wrapping reformat of the database file (no schema/column/constraint changes), plus an additive per-DAO Manager API (e.g. channelDao.managers.channels.filter(...).get()). The existing builder API call sites are unchanged.

No source .dart files were modified — only generated outputs.

Test plan

CI green
Verify flutter pub get resolves cleanly in a consumer app that depends on:
- device_info_plus ^13.0.0
- package_info_plus ^10.0.0
- share_plus ^13.0.0
- file_picker ^11.0.0
Smoke test file attachment picking on iOS, Android, and Web (file_picker API migrated)
Smoke test gallery share button on iOS/Android (share_plus floor raised)

🤖 Generated with Claude Code

… plus-plugin majors - llc: bump `jose` floor to ^0.3.5+1 (CVE-2026-34240 — untrusted JWK header in signature verification; SDK only uses the unverified decoder, so not directly exploitable, but the floor bump ensures consumers resolve to a patched version) - ui: bump `file_picker` to ^11.0.0 and migrate from `FilePicker.platform.X()` to static `FilePicker.X()`; resolves #2599 - core: widen `device_info_plus` to `>=12.4.0 <14.0.0`, `package_info_plus` to `>=9.0.1 <11.0.0`, `connectivity_plus` to `>=7.1.1 <8.0.0` - ui: widen `share_plus` to `>=12.0.2 <14.0.0` - all: raise minimum versions of bundled dependencies to their resolved versions - `freezed_annotation` floor intentionally kept at `>=2.4.1` to avoid forcing consumers to migrate to freezed 3.x Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Raises minimum versions of dev-only dependencies to their current resolved versions, all compatible with our Flutter 3.38.1 / Dart 3.10 floor: - `build_runner` ^2.4.9 → ^2.15.0 - `connectivity_plus_platform_interface` ^2.0.0 → ^2.1.0 - `drift_dev` ^2.28.0 → ^2.33.0 - `fake_async` ^1.3.1 → ^1.3.3 - `faker_dart` ^0.2.1 → ^0.2.3 - `flutter_launcher_icons` ^0.14.2 → ^0.14.4 - `json_serializable` ^6.7.1 → ^6.13.2 - `mocktail` ^1.0.0 → ^1.0.5 - `path` (dev) ^1.8.3 → ^1.9.1 - `path_provider_platform_interface` ^2.0.0 → ^2.1.2 - `plugin_platform_interface` ^2.0.0 → ^2.1.8 - `test` ^1.24.6 → ^1.31.1 - `theme_extensions_builder` ^7.2.0 → ^7.3.0 `freezed` constraint kept at `>=2.4.2 <4.0.0` to stay consistent with the runtime `freezed_annotation` range. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Regenerates `.g.dart` and `.freezed.dart` outputs after bumping `freezed`, `json_serializable`, `drift_dev`, and `build_runner` to their latest versions. - `.g.dart` (json_serializable 6.13.2): `toJson` now uses Dart's null-aware map element syntax (`'key': ?nullableExpr`) instead of the older `if (... case final v?) 'key': v` pattern. Behaviour is identical — null entries are omitted from the JSON output either way. - `.freezed.dart` (freezed 3.x): cosmetic formatting differences only; classes, mixins, copy-with implementations, and equality/hashCode are unchanged. - Drift DAO `.g.dart` (drift_dev 2.33): adds the new per-DAO Manager API (`channelDao.managers.channels.filter(...).get()` etc.) alongside the existing builder API. Purely additive; existing call sites are unaffected. - `drift_chat_database.g.dart`: heavy line-wrapping reformat from newer drift_dev; no schema, column, or constraint changes. No source `.dart` files were modified — only generated outputs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-05-12T15:43:16Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 37a70414-547c-4dcb-aa0c-9e90fca86e47

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/v10-dep-bumps

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov · 2026-05-12T15:53:00Z

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 67.43%. Comparing base (8bfb68b) to head (0aa6e0d).

Files with missing lines	Patch %	Lines
...tachment/handler/stream_attachment_handler_io.dart	0.00%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff            @@
##           v10.0.0    #2644   +/-   ##
========================================
  Coverage    67.43%   67.43%           
========================================
  Files          412      412           
  Lines        24551    24551           
========================================
  Hits         16557    16557           
  Misses        7994     7994

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

renefloor · 2026-05-13T07:29:21Z

+      cached_network_image: ^3.4.1
+      chewie: ^1.13.1
+      collection: ^1.19.1
+      connectivity_plus: ">=7.1.1 <8.0.0"


I would change this to a regular caret notation

Suggested change

connectivity_plus: ">=7.1.1 <8.0.0"

connectivity_plus: "^7.1.1"

renefloor · 2026-05-13T07:29:39Z

      cupertino_icons: ^1.0.3
-      desktop_drop: '>=0.5.0 <0.8.0'
-      device_info_plus: '>=11.0.0 <13.0.0'
+      desktop_drop: '>=0.7.1 <0.8.0'


I would change this to a regular caret notation

Suggested change

desktop_drop: '>=0.7.1 <0.8.0'

desktop_drop: '^0.7.1'

renefloor · 2026-05-13T07:29:56Z

+      jiffy: ^6.4.4
+      jose: ^0.3.5+1
+      json_annotation: ^4.11.0
+      just_audio: ">=0.10.5 <0.11.0"


Suggested change

just_audio: ">=0.10.5 <0.11.0"

just_audio: "^0.10.5"

renefloor · 2026-05-13T07:30:21Z

+      fake_async: ^1.3.3
+      faker_dart: ^0.2.3
+      flutter_launcher_icons: ^0.14.4
      freezed: ">=2.4.2 <4.0.0"


Maybe we can also increase the minimum of freezed to 3.0 now?

@renefloor

…zed floor to 3.0 Addresses PR review feedback from @renefloor: - connectivity_plus, desktop_drop, just_audio: use caret notation - freezed: bump minimum to 3.0 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

# Conflicts: # packages/stream_chat_flutter/CHANGELOG.md

xsahil03x and others added 3 commits May 12, 2026 17:39

This was linked to issues May 12, 2026

jose Security Vulnerability #2589

Closed

Unable to use latest Flutter packages alongside stream_chat_flutter #2599

Open

xsahil03x mentioned this pull request May 12, 2026

fix(deps): bump jose minimum to ^0.3.5+1 #2613

Closed

3 tasks

renefloor reviewed May 13, 2026

View reviewed changes

xsahil03x and others added 3 commits May 18, 2026 05:18

chore(deps): bump freezed_annotation floor to 3.0 to match freezed

dd795dc

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Merge remote-tracking branch 'origin/v10.0.0' into chore/v10-dep-bumps

0aa6e0d

# Conflicts: # packages/stream_chat_flutter/CHANGELOG.md

xsahil03x merged commit a58afdb into v10.0.0 May 18, 2026
9 of 10 checks passed

xsahil03x deleted the chore/v10-dep-bumps branch May 18, 2026 04:28

xsahil03x mentioned this pull request May 18, 2026

fix(llc): bump jose floor to 0.3.5+1 for CVE-2026-34240 #2658

Merged

6 tasks

xsahil03x mentioned this pull request May 28, 2026

feat(repo)!: v10.0.0 #2499

Open

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps)!: bump dep floors, widen plus-plugin majors, migrate file_picker 11#2644

chore(deps)!: bump dep floors, widen plus-plugin majors, migrate file_picker 11#2644
xsahil03x merged 6 commits into
v10.0.0from
chore/v10-dep-bumps

xsahil03x commented May 12, 2026

Uh oh!

coderabbitai Bot commented May 12, 2026 •

edited

Loading

Review skipped

Uh oh!

codecov Bot commented May 12, 2026 •

edited

Loading

Uh oh!

renefloor May 13, 2026

Uh oh!

renefloor May 13, 2026

Uh oh!

renefloor May 13, 2026

Uh oh!

renefloor May 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	connectivity_plus: ">=7.1.1 <8.0.0"
	connectivity_plus: "^7.1.1"

Conversation

xsahil03x commented May 12, 2026

Summary

Breaking change

Security

Plus-plugin widenings (issue #2599 family)

Floor bumps to current resolved versions

Codegen regeneration

Test plan

Uh oh!

coderabbitai Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

codecov Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

renefloor May 13, 2026

Choose a reason for hiding this comment

Uh oh!

renefloor May 13, 2026

Choose a reason for hiding this comment

Uh oh!

renefloor May 13, 2026

Choose a reason for hiding this comment

Uh oh!

renefloor May 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented May 12, 2026 •

edited

Loading

codecov Bot commented May 12, 2026 •

edited

Loading