Skip to content

Strip plugins created from dev_dependencies from release-mode apps #56591

Description

@jonahwilliams

2024-11-21 update from @matanlurey:


Currently the flutter tool creates a plugin for all package dependencies, even though in the dev_dependencies section. We'd like to remove this behavior, since it can lead to plugins used for testing accidentally getting included in released builds. This will be a breaking change, so we can proceed in several steps.

  1. Compute both the current and dependencies-only plugin list and use the current strategy. If discrepancies are found, print a warning that this will be disabled in a future release and how to fix.

  2. Compute both the current and dependencies-only plugin list and use the dependencies only strategy. If discrepancies are found, print a warning/notification that certain plugins have been disabled and include how to fix.

  3. Remove the current strategy, remove the warning.

Activity

  1. added
    toolAffects the "flutter" command-line tool. See also t: labels.
    on May 7, 2020
  2. dnfield commented on Dec 8, 2020

    @dnfield
    Contributor

    I think, ideally, it would be possible to include or not include a plugin based on a build flag or somesuch.

    for integration_test (formerly known as e2e), we need some way to include the plugin in builds that need it, and strip it out for builds that do not.

  3. dnfield commented on Dec 8, 2020

    @dnfield
    Contributor

    IOW, it seems like it'd be very nice if the tool could do something like this: if a plugin is in dev_dependencies, ignore it unless building for a test target (do not add it to any generated files for "regular" builds).

    We'd need some meaningful way to discriminate between test builds and non.

  4. added
    a: buildBuilding flutter applications with the tool
    a: tests"flutter test", flutter_test, or one of our tests
    on Dec 8, 2020
  5. dnfield commented on Dec 8, 2020

    @dnfield
    Contributor

    /cc @blasten @jmagman who probably know a lot more about how or if this could work on Android and iOS.

  6. jmagman commented on Dec 8, 2020

    @jmagman
    Member

    Is this different from #49101 or #45714?

    On the iOS side this would be easy to do if .flutter-plugins-dependencies indicated which were dev-only.

  7. dnfield commented on Dec 8, 2020

    @dnfield
    Contributor

    It's very similar, although I guess this one is proposing a specific solution to it that's a bit different from what I'm suggesting.

  8. blasten commented on Dec 8, 2020

    @blasten

    yeah, that can be added to .flutter-plugins-dependencies.

    IOW, it seems like it'd be very nice if the tool could do something like this: if a plugin is in dev_dependencies, ignore it unless building for a test target (do not add it to any generated files for "regular" builds).

    That probably requires generating a new plugin registrant based on which target the user is running. In Objective-C you could use compile-time constants passed to Xcode, right @jmagman ?

  9. dnfield commented on Dec 8, 2020

    @dnfield
    Contributor

    When do we re-generate the GeneratedPluginRegistrant code?

  10. blasten commented on Dec 8, 2020

    @blasten

    pub get, currently

  11. jmagman commented on Dec 8, 2020

    @jmagman
    Member

    if (androidPlatform) {
    await _writeAndroidPluginRegistrant(project, plugins);
    }
    if (iosPlatform) {
    await _writeIOSPluginRegistrant(project, plugins);
    }
    if (linuxPlatform) {
    await _writeLinuxPluginFiles(project, plugins);
    }
    if (macOSPlatform) {
    await _writeMacOSPluginRegistrant(project, plugins);
    }

    That probably requires generating a new plugin registrant based on which target the user is running

    Why would the native-side app ever need to register dev_dependencies?

  12. dnfield commented on Dec 8, 2020

    @dnfield
    Contributor

    Why would the native-side app ever need to register dev_dependencies?

    Because for integration_test, it has to report test results up to the native side test harness - e.g. to XCTest or JUnit.

  13. jmagman commented on Dec 8, 2020

    @jmagman
    Member

    Then shouldn't the test target be handling the registration?

  14. 26 remaining items

  15. matanlurey commented on Oct 23, 2024

    @matanlurey
    Contributor

    Ok here is a potential crappy algorithm:

    1. Create a Set<String> devDependencies
    2. Create a sub-set nonDevDependencies = dependencies.difference(devDependencies)
    3. Recurse nonDevDependencies, and remove dependencies of each from devDependencies

    ... and I think you're left with a set of devDependenciesThatAreOnlyUsedAsSuch?

  16. jonahwilliams commented on Oct 23, 2024

    @jonahwilliams
    ContributorAuthor

    Yeah, I think in practive plugins depending directly on other plugins is very rare and I wouldn't be too worried about it.

  17. matanlurey commented on Oct 23, 2024

    @matanlurey
    Contributor

    It's common enough for things like path_provider and such.

    Let me see if it's fairly trivial, and if not we can re-think.

  18. jonahwilliams commented on Oct 23, 2024

    @jonahwilliams
    ContributorAuthor

    I guess I don't really see what the problem is. Yes bar_plugin is a dev_dependency, but dev_dependency doesn't mean "must exclude from build", it just means "not included by default" If you have another depdency link to bar_plugin then we're still doing what you asked.

  19. matanlurey commented on Oct 23, 2024

    @matanlurey
    Contributor

    The problem is we need to know what plugins to exclude, in which what heuristic we're using is "plugins that are exclusively used as dev_dependencies". Exclusively is the part that requires a bit of computation.

    Maybe there is an easier way to approach this and I'm missing something?

  20. jonahwilliams commented on Oct 23, 2024

    @jonahwilliams
    ContributorAuthor

    I think exclusively in dev_dependencies is the right way to think about it.

    Exclusively is the part that requires a bit of computation.

    Yeah that part is unfortuante

  21. matanlurey commented on Oct 23, 2024

    @matanlurey
    Contributor

    I have to head off for a bit, but basically I'd be implementing this: #157462.

  22. changed the title [-]Do not create plugins from dev_dependencies[/-] [+]Strip plugins created from `dev_dependencies` from release-mode apps[/+] on Nov 19, 2024
  23. matanlurey commented on Feb 22, 2025

    @matanlurey
    Contributor

    As of the latest master (#160289), this is enabled by default for --release mode apps for all platforms (the plugin automatically becomes inert). Android also removes the dependencies, but iOS, Web, and Desktop do not; however that last bit as an optimization is not covered here.

    Marking done!

  24. github-actions commented on Mar 8, 2025

    @github-actions

    This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.

  25. locked as resolved and limited conversation to collaborators on Mar 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

P2Important issues not at the top of the work lista: buildBuilding flutter applications with the toola: pluginsSupport for writing, building, and running plugin packagesa: tests"flutter test", flutter_test, or one of our testsf: integration_testThe flutter/packages/integration_test pluginteam-toolOwned by Flutter Tool teamtoolAffects the "flutter" command-line tool. See also t: labels.triaged-toolTriaged by Flutter Tool team

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions