Repository navigation
fix(mobile): bump Flutter to 3.47.9 for Android TLS fix - #9309
Merged
Merged
Conversation
Flutter 3.47.7's bundled Dart TLS verifier on Android misses the platform's compromised-intermediate blocklist (GHSA-frr6-h895-5pxp), so Android builds accept certificates from the compromised eMudhra intermediates. 3.47.8+ carries the fix. Signed-off-by: Tom Brow <tomb@squareup.com>
brow
marked this pull request as ready for review
November 9, 2026 23:07
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
brow
enabled auto-merge (squash)
November 9, 2026 23:08
🔐 Codex Security Review
Review SummaryOverall Risk: NONE
FindingsNo concrete security, correctness, or reliability findings were identified. Notes
Generated by Codex Security Review | |
kalvinnchau
approved these changes
Nov 9, 2026
wpfleger96
added a commit
that referenced
this pull request
Nov 10, 2026
…e-mode * origin/main: ci(docker): skip relay image publishes for main pushes outside the build context (#9310) Add manual-only relay image publishing (#9303) fix(mobile): bump Flutter to 3.47.9 for Android TLS fix (#9309) Serve video and poster previews for invite links (#9306) docs: point the README to Buzz 1.0 in block/buzz-app (#9296) fix(db): give the replica-fence probe its own pool and instrument it (#9297) fix(relay): never close connections when cross-node fan-out falls behind (#9302) test: fix timing-dependent unit tests in buzz-cli, buzz-agent and buzz-admin (#9273) fix(ci): classify hermit retry timeouts by watchdog kill, not whole seconds (#9274) test(ios): wait for a key, foreground-active window before presenting in RunnerTests (#9275) test(desktop): wait on real readiness signals in audience and community-rail specs (#9277) Signed-off-by: Will Pfleger <wpfleger@block.xyz>
philazar
added a commit
that referenced
this pull request
Nov 10, 2026
* origin/main: Add swipeable photo stacks and native iOS gallery preview (#9259) ci(docker): skip relay image publishes for main pushes outside the build context (#9310) Add manual-only relay image publishing (#9303) fix(mobile): bump Flutter to 3.47.9 for Android TLS fix (#9309) Serve video and poster previews for invite links (#9306) docs: point the README to Buzz 1.0 in block/buzz-app (#9296) Signed-off-by: Philip Azar <pazar@squareup.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Flutter 3.47.7's bundled Dart TLS verifier on Android misses Android's compromised-intermediate blocklist and, on Android 14+, reads the older CA directory (GHSA-frr6-h895-5pxp). An on-path attacker can therefore impersonate the relay to Android builds with a certificate chained to the compromised eMudhra intermediates. Flutter 3.47.8+ ships the patched verifier. This bumps the hermit pin to the latest patch, 3.47.9 (Dart 3.13.7), and raises the SDK floor in
pubspec.yamland CONTRIBUTING to match.Tracked in BSEC-29. iOS and macOS use Apple's certificate verification and aren't affected by this advisory.
Patch-level bump within 3.47: no source, formatter or dependency changes were needed;
pubspec.lockonly changes the Flutter floor. No visible change, so no screenshots.Validation
flutter analyze: no issues.dart format: no changes.🤖 Generated with Claude Code