Packages with example apps opted-in for null safety fail the null safety checks

[amirh]

This came up in flutter/flutter#69440 (comment) where a bunch of flutter/plugins packages started failing on CI.

@zanderso and @leafpetersen pointed out that the failing packages included example apps with no Dart SDK constraints which means they are treated as opted-in for null safety.

While the flutter/plugins packages are fixed in flutter/plugins#3240 it's somewhat worrying that many other packages in the ecosystem will take a similar hit.

I counted the affected packages across pub and there are currently 725 packages with example apps that are opted-in for null safety (most likely unintentionally as null safety isn't launched yet).

698 of these packages are actually not opted-in for null safety (e.g the root pubspec.yaml isn't opted-in while example/pubspec.yaml is opted in).
For these 698 packages I believe it should be safe to assume that the sdk constraint in example/pubspec.yaml should be intersected with the sdk constraints of the root pubspec.yaml. So it's fairly easy to automate the fix.

The list of the 698 "fixable" packages is available in this sheet.

I'm happy to send PRs using dart_lsc to fix example/pubspec.yaml for as many of these 698 packages as possible.
I guess another alternative to consider would be to somehow teach the analyzer that the example app's sdk constraint cannot be wider than the package's sdk constraint.

cc @mit-mit @csells

[mit-mit]

The root cause here is that when a project doesn't have an SDK lower bound, no language version is written into .dart_tool/package_config.json.

[mit-mit]

Jonas logged https://github.com/dart-lang/pub-dev/issues/4208 for a potential pub change. Please thumbs up/down/comment there for that proposal.

[leafpetersen]

We have reports of users downstream of packages that have no lower sdk constraint getting broken on master. For example, these two packages are broken on master. I see two options here:

• Manually fix up the broken packages on pub (may be difficult to get PRs landed)
• Change the interpretation of missing lower bounds to mean "2.7" instead of "latest".

I think we likely need to do one or the other for beta. cc @franklinyow @jonasfj @natebosch @lrhn @jakemac53 @munificent

[franklinyow]

@leafpetersen
Are you saying that we need additional work in additional to dart-lang/pub#2707?

[amirh]

List of affected packages: https://docs.google.com/spreadsheets/d/1b3zD8TGfl6yxSJF-ZXjzg0hKluY-kXWcIPVF-5hUiME/edit#gid=513901545

[mit-mit]

Discussed in language team, and agreed that:

• Keep the current ERROR when resolving a pubspec that itself is missing one or more parts of the upper/lower Dart SDK constraint
• Add new logic in pub get that for dependencies which do not have a lower constraint in their pubspec, defaults the language version to 2.7, and write that to the package config

[leafpetersen]

I filed issues for the known tools that need to change here:

• Analyzer should interpret a missing sdk lower constraint as 2.7 #44159
• generate_package_config.dart needs to treat missing sdk lower bounds as 2.7 #44160
• Flutter tools that derive language versions from pubspec.yaml should interpret a missing min constraint as 2.7 flutter/flutter#70349

I'm assuming this issue will cover the pub work - if not @jonasfj can you file one there?

[mit-mit]

Pub was updated in dart-lang/pub#2748

[jonasfj]

Rolled in https://dart-review.googlesource.com/c/sdk/+/171720

[jonasfj]

@pcsosinski @franklinyow, have beta been cut yet? If so we would like to cherry-pick: 4b3840d
(I can't seem to find a branch that looks like it is beta for 2.12 -- maybe I'm just missing something obvious :D)

[jonasfj]

Filed cherrypick request: #44176

[timsneath]

@mit-mit Will this behavior (default for packages missing SDK constraint) be documented somewhere on dart.dev?

[mit-mit]

We weren't planning on documenting this particular change. Note that we didn't change the behavoir for running pub get in a directory with a pubspec not containing an SDK constraint. That continues to be an error (as described in the breaking change).

But this makes a small tweak to the behavoir when you run pub get on a pubspec that contains a dependency, and the pubspec of that dependency doesn't have an SDK constraint. In that case, we default the dependency to be 2.7. The owner of the dependency will get the error when they pub get, so they already have the needed message (and docs for that).

[leafpetersen]

We weren't planning on documenting this particular change

Agreed. This change just makes existing packages continue to work, all new packages will be required to have an sdk constraint.