How to determine the versions used in Flutter SDK 3.24.5?

Help General
,
1

We are using flutter sdk version 3.24.5. As part of SCA scan on apk, we have found below dependencies without any release version

List of dependencies

  1. BoringSSL

  2. Protobuf

  3. nanopb

  4. FlatBuffers

  5. google/skiacanvaskit

  6. libjpeg-turbo

  7. libpng

  8. The FreeType Project

The tool used for scanning is Blackduck.

We would like to understand which version of the above dependencies are included in flutter engine ie libflutter.so

For example, in Blackduck scanning tool we get libpng dependency reference from libpng Home Page we understand that flutter fetches the latest released version at the time of releasing flutter engine. Thus, based on the tags we have considered v1.6.44

&

BoringSSL dependency reference from platform/external/boringssl - Git at Google we understand that flutter fetches the latest released version at the time of releasing flutter engine. Thus, based on the tags we have considered android-14.0.0+r11

In DEPS file we found commit Id but we need to find exact version.

Is there any way to trace the exact versions bundled with this Flutter SDK release? Are there specific files or dependencies that provide this information?

4

Determining the exact versions of dependencies bundled within a specific Flutter SDK release, such as version 3.24.5, involves examining the Flutter Engine’s DEPS file, which lists the commit hashes for each dependency. The DEPS file resides in the Flutter Engine’s GitHub repository. For Flutter 3.24.5, identify the corresponding engine commit by checking the Flutter SDK’s bin/internal/engine.version file. Within the DEPS file, each dependency is associated with a specific commit hash. Visit the respective dependency’s repository and locate the commit corresponding to the hash found in the DEPS file. This will indicate the exact version or state of the dependency at that commit.

1 Like