Analyze is failing, Warning: transitive closure contained non-allowlisted packages: [frontend_server_client] #80909

Activity

1. jmagman

   added

   c: contributor-productivityTeam-specific productivity, code health, technical debt.Team-specific productivity, code health, technical debt.

   toolAffects the "flutter" command-line tool. See also t: labels.Affects the "flutter" command-line tool. See also t: labels.

   P0Critical issues such as a build break or regressionCritical issues such as a build break or regression

   on Apr 22, 2021
2. jmagman commented on Apr 22, 2021

   

   jmagman

   on Apr 22, 2021

   MemberAuthor

   More actions

   test_core 0.3.20 was just published an hour ago and is the package with the frontend_server_client dependency, unless I'm missing something.
3. Hixie commented on Apr 22, 2021

   

   Hixie

   on Apr 22, 2021

   Contributor

   More actions

   Git bisect points to f6f59c5, which is when we added the allow list, which suggests that somehow our fixed pins are not working and we got caught by an upstream change. That's not supposed to be possible.
4. jmagman commented on Apr 22, 2021

   

   jmagman

   on Apr 22, 2021

   MemberAuthor

   More actions

   frontend_server_client was added in dart-lang/test#1399. I'm not sure why the script picked up an unpinned version, but it looks legit to be added to the allowlist in the meantime. @jonahwilliams @jakemac53 do you agree?
5. Hixie commented on Apr 22, 2021

   

   Hixie

   on Apr 22, 2021

   Contributor

   More actions

   dev dependencies should be pinned too, right?
6. jonahwilliams commented on Apr 22, 2021

   

   jonahwilliams

   on Apr 22, 2021

   Contributor

   More actions

   I suspect this is a bug in the --transitive-closure script in update packages. I'll plan on taking a look, but in the meantime we can add that package to the allowlist since its a dev_dep anyway. Maybe we should count dev deps separately anyway.
7. jonahwilliams commented on Apr 22, 2021

   

   jonahwilliams

   on Apr 22, 2021

   Last edited by jonahwilliams

   Contributor

   More actions

   This is how it happens: update-packages tries to avoid pinning "transitive dependencies" in the synthetic pubspec, since its goal is to allow easy upgrades to the latest version of everything. --transitive-closure just wants to show the dependencies as they exist today, but re-uses the update-packages logic to generate a synthetic package. Since test_core is not pinned in this synthetic package, we version solve to the latest version and show frontend_server_client in the dep list - even though nothing in our repo is updated to use this

   👍React with 👍2Reacted by Jenn Magder and Jacob MacDonald
8. jakemac53 commented on Apr 22, 2021

   

   jakemac53

   on Apr 22, 2021

   Contributor

   More actions

   I don't see any alternative to pinning it. If it becomes a problem we can copy it into package:test_core instead, but I think it should be fine to pin for now.
9. jonahwilliams commented on Apr 22, 2021

   

   jonahwilliams

   on Apr 22, 2021

   Contributor

   More actions

   So the bug is on our end, and I'll take a look at fixing that - in the meantime we can add it to the allowlist to unblock the tree

   👍React with 👍3Reacted by Ian Hickson, Greg Spencer and Jacob MacDonald
10. jmagman commented on Apr 22, 2021

    

    jmagman

    on Apr 22, 2021

    MemberAuthor

    More actions

    Workaround #80912 merged, tree should be unblocked.
    Lowering priority.
11. jmagman

    added

    P1High-priority issues at the top of the work listHigh-priority issues at the top of the work list

    and removed

    P0Critical issues such as a build break or regressionCritical issues such as a build break or regression

    on Apr 22, 2021
12. jonahwilliams

    closed this as completedin #80911on Apr 22, 2021
13. 7 remaining items

    Load more
14. flutter-triage-bot

    added

    team-toolOwned by Flutter Tool teamOwned by Flutter Tool team

    triaged-toolTriaged by Flutter Tool teamTriaged by Flutter Tool team

    on Jul 8, 2023
15. matanlurey

    self-assigned this

    on Jul 10, 2025
16. matanlurey

    added

    c: tech-debtTechnical debt, code quality, testing, etc.Technical debt, code quality, testing, etc.

    tool-still-validIssues that have been deemed still valid as part of the Flutter Tools issue cleanup initiative.Issues that have been deemed still valid as part of the Flutter Tools issue cleanup initiative.

    team-infraOwned by Infrastructure teamOwned by Infrastructure team

    triaged-infraTriaged by Infrastructure teamTriaged by Infrastructure team

    fyi-toolFor the attention of Flutter Tool teamFor the attention of Flutter Tool team

    and removed

    team-toolOwned by Flutter Tool teamOwned by Flutter Tool team

    on Jul 10, 2025
17. flutter-triage-bot

    removed

    fyi-toolFor the attention of Flutter Tool teamFor the attention of Flutter Tool team

    triaged-toolTriaged by Flutter Tool teamTriaged by Flutter Tool team

    on Jul 10, 2025
18. matanlurey commented on Jul 21, 2025

    

    matanlurey

    on Jul 21, 2025

    Contributor

    More actions

    The allow-list check does use pub deps currently.
19. matanlurey

    closed this as completedon Jul 21, 2025
20. github-actions commented on Aug 4, 2025

    

    github-actionsbot

    on Aug 4, 2025 – with GitHub Actions

    More actions

    This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.
21. github-actions

    locked as resolved and limited conversation to collaborators on Aug 4, 2025