flutter-common 3.41.2-3
Flutter SDK component - common SDK files and pub cache
config.json file.
/v1/packages/flutter-common/versions SHAs are authoritative.
Metadata
Relations
Make dependencies
Security
Revision scans
| Revision | Status | Scanned | Findings |
|---|---|---|---|
| 630b7f9e7ec5head | verified | 2026-11-05 16:16 | 30 |
Head findings
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_flutterarch=$(echo "$CARCH" | sed s/aarch64/arm64/ | sed s/x86_64/x64/)
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
DART_BINARY=$(readlink $(command -v dart))
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
echo -e " Dart executable: $(command -v dart)"
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
"engineRevision": "$(cat "${srcdir}/${_group}/bin/internal/engine.version")",command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
"dartSdkVersion": "$(dart --version | awk '{print $4}')",command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
"devToolsVersion": $(jq '.version' < ${DART_ROOT}/bin/resources/devtools/version.json),risky-tool
in
PKGBUILD'gradle' is invoked - this fetches/executes external code outside alpm's control.
gradle init --type basic --project-name flutter --dsl kotlin --incubating
risky-tool
in
PKGBUILD'gradle' is invoked - this fetches/executes external code outside alpm's control.
gradle wrapper
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
DART_BINARY=$(readlink $(command -v dart))
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
$(declare -f "_package${_p#$_group}")command-substitution
in
flutter-common.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
MAJOR=$(echo $OLD | awk -F '.' '{print $1}')command-substitution
in
flutter-common.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
MINOR=$(echo $OLD | awk -F '.' '{print $2}')command-substitution
in
flutter-common.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
PATCH=$(echo $OLD | awk -F '+' '{print $1}' | awk -F '.' '{print $3}')command-substitution
in
flutter-common.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
MAJOR=$(echo $OLD | awk -F '.' '{print $1}')command-substitution
in
flutter-common.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
MINOR=$(echo $OLD | awk -F '.' '{print $2}')command-substitution
in
flutter-common.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
PATCH=$(echo $OLD | awk -F '+' '{print $1}' | awk -F '.' '{print $3}')command-substitution
in
flutter.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
DART_BINARY=$(readlink $(which dart))
command-substitution
in
flutter.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
if [ "$(id -u)" = "0" ] && ! [ -f /.dockerenv ] && [ "$CI" != "true" ] && [ "$BOT" != "true" ] && [ "$CONTINUOUS_INTEGRATION" != "true" ]; then
command-substitution
in
update-artifact-versions.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
readonly ENGINE_VERSION="$(cat src/flutter/bin/internal/engine.version)"
command-substitution
in
update-artifact-versions.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
readonly MATERIAL_FONTS_VERSION="$(cat src/flutter/bin/internal/material_fonts.version | cut -d '/' -f4)"
command-substitution
in
update-artifact-versions.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
readonly GRADLE_WRAPPER_VERSION="$(cat src/flutter/bin/internal/gradle_wrapper.version | cut -d '/' -f3)"
command-substitution
in
update-artifact-versions.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
readonly LIBIMOBILEDEVICE_VERSION="$(cat src/flutter/bin/internal/libimobiledevice.version)"
command-substitution
in
update-artifact-versions.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
readonly USBMUXD_VERSION="$(cat src/flutter/bin/internal/libusbmuxd.version)"
command-substitution
in
update-artifact-versions.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
readonly LIBPLIST_VERSION="$(cat src/flutter/bin/internal/libplist.version)"
command-substitution
in
update-artifact-versions.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
readonly OPENSSL_VERSION="$(cat src/flutter/bin/internal/openssl.version)"
command-substitution
in
update-artifact-versions.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
readonly IOS_DEPLOY_VERSION="$(cat src/flutter/bin/internal/ios-deploy.version)"
command-substitution
in
update-artifact-versions.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
readonly SDK_VERSION="$(cat src/dart/dart-sdk/version)"
command-substitution
in
update-artifact-versions.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
readonly SDK_STRING="$(grep sdk src/flutter/packages/flutter_tools/pubspec.yaml | awk -F "'" '{print $2}')"command-substitution
in
update-artifact-versions.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
readonly SDK_MIN="$(echo $SDK_STRING | awk -F '=' '{print $2}' | awk -F '-' '{print $1}')"command-substitution
in
update-artifact-versions.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
readonly SDK_MAX="$(echo $SDK_STRING | awk -F '<' '{print $2}' | awk -F '-' '{print $1}')"Findings below High severity are retained for review but do not block serving. Verified means no obvious red flags from static analysis - never a guarantee that a package is safe.