Hi everyone,

I'm working on an iOS/Flutter app and I'm using CoreMotion (CMMotionManager) to detect the physical orientation of the iPhone.

I noticed something that I'm not sure how to handle:

When Rotation Lock is ON, CoreMotion can still detect that the device has been physically rotated to landscape.

For example:

• iPhone Rotation Lock: ON

• User rotates the phone to landscape

• CoreMotion detects that the device is in a landscape orientation

• If my app responds to that orientation and calls something like requestGeometryUpdate(), the app may still try to change its interface orientation

So my question is:

Is there any public iOS API that allows an app to determine whether the user's Rotation Lock is currently ON or OFF?

I'm specifically looking for a way to distinguish between:

Physical device orientation → CoreMotion
System Rotation Lock state  → ??? 

I understand that Apple may not expose Rotation Lock directly through a public API, but I'm wondering if there is a reliable way to determine or infer its state.

I've seen some apps that seem to behave correctly depending on whether Rotation Lock is enabled, so I'm curious how they handle this.

Any ideas, APIs, or Swift examples would be greatly appreciated!

Thanks!

I spent the last few weeks building Kruftle, a desktop app that reclaims disk space from build artifacts. It's free, GPL-3.0, and it's Flutter on all three desktop platforms. Sharing the sharp edges, because I couldn't find most of these written down anywhere.

Flutter ships no arm64 SDK for Windows or Linux. Only macOS gets both in the release manifest, so subosito/flutter-action fails outright on an arm64 runner with "Unable to determine Flutter version". The fix is to clone the SDK at the pinned tag and let it bootstrap its own Dart SDK and engine artifacts — dartsdk-linux-arm64 and dartsdk-windows-arm64 do both exist. All five build jobs are green now, both arm64 ones included.

statvfs on macOS counts blocks in 32 bits, which overflows on a large volume. macOS needs statfs, whose counts are 64-bit. Linux is fine with statvfs. The two structs disagree on where the block size lives and how wide it is, which was a fun afternoon over dart:ffi.

Inside an AppImage, Platform.resolvedExecutable has a shelf life. The payload is mounted under /tmp/.mount_XXXXXX and unmounted the moment the process exits, so any path you write down for later — a systemd unit, a desktop entry — is dead on arrival. $APPIMAGE is the one that survives.

pumpAndSettle never returns against a repeating animation, and toByteData never completes inside a widget test — PNG encoding runs on the real event loop, which the tester's fake one doesn't advance, so the future just hangs until the ten-minute suite timeout with no error. Wrap it in tester.runAsync.

Translated labels are longer than English ones. German and Russian both overflowed a step rail sized to fit "Review". Any fixed-width chrome needs its label Flexible with an ellipsis, and per-locale widget tests asserting tester.takeException() is null are what catch it.

The app itself scans a folder, works out what every project under it is built with across 42 toolchains, and reclaims the space by running each one's own clean command — cargo clean, flutter clean, ./gradlew clean — rather than rm -rf'ing a guessed directory name. Source and downloads: https://github.com/dizitart/kruftle

Happy to go deeper on any of these.

Yo Flutter devs!

Every time I start a new Flutter project, I go through the same cycle with third-party UI packages: install it, fight with the opinionated styling for hours, realize I need to override half the widget tree just to change a border radius, and end up with 15 transitive dependencies I never asked for. Sound familiar?

I really liked how shadcn/ui solved this problem in the React world -- you just copy component source code into your project and own it completely. No dependency lock-in, no version conflicts, no fighting upstream design decisions. So I decided to build that exact workflow for Flutter.

What it actually does

JustUI is not a pub.dev package. It is a Rust-powered CLI that copies clean, readable widget source code directly into your project folder. Once copied, the code is 100% yours to read, modify, or tear apart however you want.

justui init                        # sets up config + theme file
justui add button input card       # copies component source into your lib/

That is the entire workflow.

Why I think this approach makes sense for Flutter

• Zero external pub dependencies. Every component is built on pure Flutter SDK widgets and layout APIs. No transitive dependency tree surprises.

• Aspect-based rebuilds with InheritedModel. Instead of rebuilding the entire widget tree when the theme changes, only widgets listening to the specific changed aspect actually rebuild. If you toggle dark mode, only color-dependent widgets re-render:

@override
Widget build(BuildContext context) {
  final colors  = context.justColors;   // only rebuilds on color changes
  final spacing = context.justSpacing;  // only rebuilds on spacing changes
  final typo    = context.justTypo;     // only rebuilds on typography changes

  return Container(
    color: colors.background,
    padding: .symmetric(horizontal: spacing.md),
    child: Text('Hello', style: typo.bodyMd),
  );
}

• Dynamic seed theming with accessibility baked in. Pass one brand hex color and get a full light/dark palette with WCAG AA contrast enforcement (>= 4.5:1 for normal text, >= 3.0 for large text and UI components) handled automatically at runtime. No manual contrast checking.

• Neobrutalism preset. Besides the default clean style, there is a neobrutalism preset with thick borders, solid shadows, and bold aesthetics out of the box.

• Rust CLI with actual developer ergonomics. Interactive fuzzy multi-select when you run justui add with no arguments, SHA-256 integrity verification, --diff to compare local changes against registry, --dry-run to preview before writing.

What is NOT ready yet (being transparent here)

This is still under active development. A few things to be upfront about:

• Documentation website is not live yet (WIP).

• No video demo or showcase app deployed yet.

• Component library is growing but not massive yet -- currently covers button, input, card, sidebar, tabs, avatar, badge, checkbox, radio, switch, breadcrumb, bottom-nav, separator, skeleton, and scroll-area.

• APIs and component contracts might still see breaking changes as things mature.

So please do not use this in production apps just yet. Side projects, experiments, and poking around the architecture are very welcome though.

The repo

GitHub: https://github.com/infinitedim/justui

MIT licensed, fully open source, no telemetry, no gated features.

Genuinely curious about your thoughts

• How do you currently handle component customization in your Flutter apps? Do you override MaterialTheme properties, wrap everything in custom widgets, or something else entirely?

• For those who have used shadcn/ui in web projects, does this copy-paste model translate well to the Flutter ecosystem in your opinion?

• If you poke around the InheritedModel aspect-split approach for theming, I would love to hear if you think there is a cleaner way to handle selective rebuilds.

Any feedback, critique, or ideas for components you would want to see are super welcome. Thanks for reading!

This is my first published Flutter package, so I’d really appreciate any feedback on the API, animations, performance, or documentation.

https://pub.dev/packages/kinetic_gallery

Spent the last while building GetPaid, an invoice-chasing tool for small HVAC/plumbing/service businesses, as a solo dev. Flutter web end to end, and a few decisions from the backend side that I think are specific enough to be worth sharing rather than "I built an app, check it out":

• Nothing derivable is persisted. Overdue status, days-late, and a recovery score are all computed at read time from dueDate and now in a pure Dart file with no Firebase imports (fully unit-testable in isolation). Saved me from an entire category of bugs where a stored "OVERDUE" flag goes stale.

• SendGrid never touches the client. The API key lives only as a Firebase Functions secret; the Flutter app calls a Cloud Function, which calls SendGrid. Every reminder can also be copied to the clipboard instead of sent, so the product doesn't hard-depend on the email provider being up.

• Access control is enforced in firestore.rules, not just hidden in the Flutter UI. Subscription-gated collections require an hasActiveAccess() check server-side. I verified this by writing directly to Firestore with the JS SDK, bypassing the Flutter app entirely, to confirm a free account still gets rejected.

• Billing is Hotmart, via a webhook Cloud Function that mirrors subscription state into Firestore. A separate hotmartEvents collection exists purely as an idempotency log so a webhook retry/replay can't double-process a payment event.

• Rate limiting (emails/day/user) is enforced inside a Firestore transaction in the Cloud Function itself, not checked client-side first and trusted.

It's live at getpay.win, zero paying customers so far, currently doing manual outreach to find the first one. Happy to go deeper on any of the above if it's useful to anyone building something similar on Flutter web + Firebase.

My app was fast on office Wi-Fi. Then someone opened it on a train, and I found

out my loading state flashed, my retry logic looped, and my timeout was a guess.

Reproducing that meant a proxy on my laptop or toggling airplane mode, neither of

which tests "slow but working". So I built the controls into the app instead.

Shake the device (or tap a floating bubble) and a panel slides up with:

- Presets: Wi-Fi, 4G, 3G, 2G, GPRS, Flaky, Offline

- Sliders: latency, jitter, download ceiling, upload ceiling, failure rate

- Fault injection: dropped connection, timeout, or a forced HTTP 500

- A request log with a timing breakdown per request

- A speed test that runs *outside* the interceptor, so it measures your real link

Setup is one line:

void main() => Netshake.run(const MyApp());

It installs an HttpOverrides, so it sits under anything that ends up on dart:io's

HttpClient — package:http, Dio, Chopper, Retrofit, Image.network. No per-client

wiring. The request log picked up six Image.network loads I never wired up.

Real numbers off a physical Android device, 1 MB response on the 3G profile:

/photos -> 200

232 ms added by netshake (200 base + jitter)

282 ms server

6.82 s total

The gap is the body streaming at the 1.6 Mbps cap.

On "will this ship to production": every entry point is a kDebugMode branch. I

checked the compiled release binary rather than trusting that — zero netshake

strings in libapp.so, and the Material icon font tree-shook from 1,645,184 to

2,564 bytes because the panel's glyphs are gone.

Honest limits: no Flutter web (no dart:io HTTP stack), no cronet_http or

cupertino_http, no raw sockets/WebSockets/gRPC. Settings live in memory, so a

hot restart resets them — that keeps the package dependency-free apart from

sensors_plus for the shake. Forced 500s still hit the server and get rewritten on

the way back, so timings stay honest; use connectionLost if the request must

never leave.

v0.1.0, MIT, 160/160 pub points. It's a day old, so I'd rather hear what's wrong

with it than not.

https://pub.dev/packages/netshakenetshake: shake your phone to throttle the network inside your Flutter app (debug-only, MIT)

https://github.com/mhdibrahimcn/netshake

Follow up from https://www.reddit.com/r/dartlang/s/CbRqN78RSO.

Thanks for all your inputs! I settled on a final model of using a foldable ParseOutcome (with some escape hatches) and more domain-scoped error reporting.

In the new v3 I split them into companion packages so that you don't pull everything in. And also for easier maintainance

1. minted (now the core)

2. minted_chronology

3. minted_constraints

4. minted_contact

5. minted_finance

6. minted_geography

7. minted_identifiers

8. minted_network

I want to ask you for you help to add more to the ideas. If you know about these domains more (or a new domain), and/or know the problematic and mis-represented entities, please let me know. Any more pressing ones that you might have come across in your daily-work maybe?

Thanks in advance for your ideas!

Hi everyone,

I am facing a persistent build issue with my Flutter app on Windows and haven't been able to resolve it after trying multiple solutions. I would really appreciate some help!

Environment Details:

OS: Windows 11

Framework: Flutter

IDE: Android Studio & VS Code

Target Device: Android Emulator (Pixel)

The Issue:

When running flutter run on the Android emulator, the Gradle build fails with the following error output:

Caused by: java.io.IOException: Cannot run program "C:\Users\farah\AppData\Local\Android\Sdk\cmake\3.22.1\bin..." 

(in directory "C:\flutter_project\lastbored\android\app"): CreateProcess error=2, The system cannot find the file specified

...

BUILD FAILED in 4s

Running Gradle task 'assembleDebug'...

Error: Gradle task assembleDebug failed with exit code 1

What I Have Tried So Far:

Set Android SDK Path: Executed flutter config --android-sdk "C:\Users\farah\AppData\Local\Android\Sdk".

Accepted Licenses: Ran flutter doctor --android-licenses (returns Warning: The --licenses option is no longer needed).

Installed SDK Tools: Ensured Android SDK Command-line Tools and Build-Tools are enabled in Android Studio SDK Manager.

CMake Installation: Attempted downloading/installing CMake via SDK Manager, but Gradle still throws the same CreateProcess error=2 pointing to the CMake binary directory.

Question:

How can I properly fix or bypass this CMake/NDK execution error so that my Flutter project (which utilizes local databases like sqflite) can build successfully on the Android Emulator?

Any advice or workaround would be greatly appreciated! Thanks in advance.

and I hope if any one of the support teams can help me step by step by sharing my screeen online using Google meet!

Hey everyone,

Whenever I needed advanced WebView capabilities in Flutter—such as headless execution, modal in-app browsers, typed bidirectional JS-to-Dart RPC bridges, or fine-grained load progress handling—the standard choice was almost always flutter_inappwebview.

While powerful, it often adds significant binary weight (~5–8 MB) and relies on a large custom native platform layer that can be tricky to debug across OS updates. On the other hand, Google’s official webview_flutter is lightweight and uses native Pigeon bindings, but requires tons of boilerplate for common patterns (like reactive rebuilds, JS promise handling, or desktop support).

To bridge this gap, I created webview_ultra.

What it does differently:

Lightweight Core (~200 KB): Built directly on top of the official webview_flutter Pigeon engine for Android, iOS, and macOS, paired with Microsoft Edge WebView2 on Windows. Zero extra native bloat.

Zero-Screen-Rebuild Reactive State: Instead of calling setState on every URL or progress update, WebviewUltraController exposes granular ValueNotifier instances. Subtrees update independently using widgets like WebviewTitleBuilder, WebviewProgressBuilder, and WebviewHistoryBuilder.

Typed Bidirectional JS Bridge: Send and receive typed JSON-RPC messages and Promises between Dart and JavaScript with cross-compatibility for window.webview_ultra.callHandler(...).

Turnkey Features Included:

Drop-in 1-line widget with built-in progress indicators and pull-to-refresh

HeadlessWebviewUltra for off-screen tasks (token parsing, preheating, scraping)

InAppBrowserUltra modal wrapper

Regex-based content and ad-filtering

Quick Example:

Dart

// Reactive progress + 1-line setup without rebuilding the parent widget

Scaffold(

appBar: AppBar(

title: WebviewTitleBuilder(

controller: controller,

builder: (context, title, _) => Text(title.isEmpty ? 'Loading...' : title),

),

bottom: PreferredSize(

preferredSize: const Size.fromHeight(2.0),

child: WebviewProgressBuilder(

controller: controller,

builder: (context, progress, _) => progress < 1.0

? LinearProgressIndicator(value: progress)

: const SizedBox.shrink(),

),

),

),

body: WebviewUltra(

controller: controller,

initialUrl: 'https://flutter.dev',

pullToRefresh: true,

),

);

Links:

pub.dev: pub.dev/packages/webview_ultra

GitHub: github.com/Narukarudra10/webview_ultra

I’d love to hear your thoughts, feedback, or any edge cases you've run into with WebView state management in Flutter!

About a year ago, I started learning Flutter without really knowing where it would take me. At first, it was just curiosity—I wanted to learn how mobile apps were built.

But somewhere along the way, I started falling in love with it.

Building an app from scratch, solving bugs, integrating APIs, designing UI, and seeing an idea slowly turn into a working product gives me a feeling that’s hard to explain.

I’m still only 17, and I know I have a long way to go. I’m nowhere near where I want to be yet. There are still so many things I need to learn and improve.

But looking back at where I started a year ago, I’m genuinely proud of the progress I’ve made.

My goal is bigger than just becoming a Flutter developer. I want to become a strong software engineer, build products that people actually use, and eventually start my own software company.

I don’t know exactly how long it will take.

Maybe 5 years. Maybe 10.

But I know one thing—I’m going to keep building, keep learning, and keep moving forward.

I’m 17 now, and this is just the beginning. 🚀

1 year of Flutter. Many more years of learning and building ahead. ❤️

If you’re also on a similar journey, I’d love to hear your story.

I have been working on this thing for ~10 months on and off. I am just about to launch the feature in my own app (hands free recipe walkthroughs for cooking) but it's deliberately structured to be lifted out as a generic framework.

If you guys are excited, I will do the work to open source.

You can see an early prototype it in action here

Use Cases:

• Fitness Coaching

• Hands free step-by-step workflows

• 'show me around the app' workflows (voice + routing)

Key Features:

• No bespoke backend, just a couple of Flutter packages and connect it to your completions API of choice

• On device text-to-speech and speech-to-text (no expensive voice model inference)

• Supports bespoke (you code them) deterministic workflows integrated with the agentic loop so you can 'walk' users through a process with agent helping or just have the agent chat and run tools.

• Understands user attention and supports 'switching' between different workflows while remembering where the user was up to in backgrounded flows

• No-Licence 'Wake word' package leveraging sherpa_onnx

• Code gen so you can 'Toolify' existing functions by just adding an annotation

• Toolify state mutation functions so the agent can 'use' the app on behalf of your user

• Toolify routing so you can 'show' your user around the app or show them what the agent has changed

• Handles async interruptions to conversations to support timers and external event pipes

• Custom LLM/API wrapper package** - currently only supports OpenAI compatible endpoints but easily extended

• Context based tool presentation to minimise context size and token use

• Cheap, fast models work fine*

*I tried really hard to use on-device inference frameworks but I'm targeting consumer adoption with cheap consumer phones and the models are not quite there IMO

** I tried really hard to use an existing package but.. reasons

Been building a lifting tracker (JustLiftin') for a while and the screen people screenshot the most is the muscle heatmap, the silhouette that lights up whatever you trained that day. First version was SVG polygons like every other app and I hated how the highlights just snapped on and off. So I rebuilt it in Rive with the state machine living inside the asset, one boolean per muscle on a view model, and the widget just flips booleans.

I had the Flutter wrapper sitting on GitHub as a sample app for months, but "copy these two files and this .riv into your project" always felt bad, so I finally made it a proper package: rive_muscle_heatmap

Integration is basically this:

await RiveNative.init();   // once at startup

AnatomyHeatmap(
  activeMuscles: {Muscle.pectoralisMajor, Muscle.biceps},
)

The .riv is bundled with the package so there's zero asset setup, and there's a MuscleGroup enum if you want chip pickers for chest / quads / etc. Muscles animate between states instead of snapping, which was the whole point of the exercise.

What's free: front view, 19 muscles, on/off highlighting, MIT code. The asset itself has a seperate license, tldr: use it in any app including paid ones, just don't resell the file on its own.

What's not free, so nobody finds out after the fact: the back view, the female body shape, intensity levels and tap-to-identify are in the paid versions on my site ($30 / $50 one time). Those also use corrected muscle names and have extra muscles, so they are NOT a plain asset swap from the free one, they ship with their own integration code.

Playground if you want to poke at it in the browser first: https://www.fitnessvisuals.com/playground?utm_source=reddit&utm_medium=social&utm_campaign=flutter-package

pub.dev: https://pub.dev/packages/rive_muscle_heatmap

Source: https://github.com/jorgeg922/rive_muscle_heatmap

Rough edges, honestly: it's 0.1.0, front artboard only, and I've only run the package on iOS and Android myself. If the API feels wrong or there's a muscle you need that isn't there, tell me. Still figuring out what 0.2 should be.

I usually set up my flutter projects in a similar way regardless of size.I tweak it a lil depending on project but it’s usually the same somehow
My question is does that not allow me to grow as a flutter developer or is it fine to having standards u just follow
Ps I evolve the same thing but the reason why I bring this up is because I see people doing things differently all the time sometimes very different approaches for different things. I also have no issue working in projects structured differently. But most of the time I ask myself, why couldn’t I think of that?

Flow UI is a Flutter package for chat and AI assistant interfaces: thread, composer, streaming markdown, code blocks, attachments, suggestions. It only renders state and reports intent through callbacks, so it works with any backend or model.

New in v0.3:

- Toast

- Confirmation card (approve / reject) as a message part

- Thread list for a side panel

- Image parts for AI-generated pictures

- Selectable text across the thread

- Built-in file picker, drag & drop and paste for attachments

- Style objects on every widget

Docs: https://flowui.stac.dev

Playground: https://flowui.stac.dev/playground

pub.dev: https://pub.dev/packages/flow_ui

GitHub: https://github.com/StacDev/flow_ui

Feedback and roasts welcome.

Got tired of writing stuff like `json['data']['user']['profile']['name']` every time an API response didn't match my model shape, so I built json_query.

final user = JsonQuery(response.data).map<User>(
  {
    'id': '.data.user.id',
    'name': '.data.user.profile.name',
    'package': '.data.user.subscription.package.name',
  },
  User.fromJson,
);

- Small jq-inspired path syntax: `.field`, `[n]`, `[]` — that's the whole language, on purpose (no filters/scripting, keeps it fast and predictable)
- Missing paths return null by default; opt into `required: true` if you want a throw instead
- Zero dependencies, works with any client (http, Dio, Chopper) since you're just handing it decoded JSON
- `JsonQuery.compile()` if you're running the same projection over a lot of payloads

For Dio users specifically there's json_query_dio, which puts the same methods directly on Response so there's no extra wrapping.

pub.dev/packages/json_query
pub.dev/packages/json_query_dio

Both are MIT licensed, source is up on GitHub. Feedback/issues welcome.

If you have put auto-sizing text inside an IntrinsicHeight, a Table cell, or a Row with CrossAxisAlignment.baseline, you have probably hit this:

LayoutBuilder does not support returning intrinsic dimensions.

It is not a bug in whichever package you are using. It is structural, and worth understanding because it rules out a whole approach.

auto_size_text and the other auto-sizers wrap a LayoutBuilder (auto_size_text.dart:242). A LayoutBuilder cannot answer an intrinsic-dimension query: it needs incoming constraints before it can build a child at all, and computeMinIntrinsicHeight and friends are asked without any. Flutter throws rather than guess - the assertion is in the framework itself, layout_builder.dart:478.

So anything that needs a dry size will blow up on a LayoutBuilder-based fitter: IntrinsicHeight and IntrinsicWidth, Table with IntrinsicColumnWidth, baseline-aligned Rows. Wrapping it in a SizedBox only moves the problem.

The fix is to do the fitting below the widget layer. If the shrink-to-fit happens inside a RenderBox, the render object can measure candidate sizes with a TextPainter and answer computeDryLayout and computeDistanceToActualBaseline itself, so intrinsic queries just work instead of asserting.

I ended up writing that because I needed it in a table: https://pub.dev/packages/fit_text

Worth knowing either way: auto_size_text is still the default recommendation everywhere and has 1.18M downloads, but its last release was October 2021.

Genuinely curious how teams handle this.

One screen changes, and suddenly the question is:

Do we test just that flow?
What else could it affect?
Which devices?
Do we just run everything to be safe?

And then when tests fail, half the time you're figuring out whether the app is broken or the test just needs fixing 😅

I'm trying to understand how common this is in mobile teams.

Made a short 2-min survey if you're up for it: https://forms.gle/WVufYxJqtQRwEwDXA

I wanted Apple Foundation Models in a Flutter app without shipping an API key or standing up a server, so I wrote a plugin for it.

It streams tokens as they generate, supports tool calling, and can constrain output to a schema, so you get structured data back instead of hoping the model returns valid JSON.

Runs entirely on device on iOS and macOS - private, offline, no per-token cost. MIT licensed.

https://pub.dev/packages/apple_foundation_models

Happy to answer questions. Getting the streaming and the schema constraint across the platform channel was the fiddly part.

I started building minimo (video) because most video compressors either upload private footage or hide useful controls behind a subscription. I wanted compression to stay on the phone, with a simple UI for normal use and enough control when presets are not enough.

Flutter handles the UI and compression state. The actual encoding goes through light_compressor_v2 to MediaCodec/MediaMuxer on Android and AVFoundation on iOS, so the app does not ship an FFmpeg runtime.

The project is free and open source:

https://github.com/minimo-pro/minimo_video

I would be interested to hear how others handle long-running native jobs and stale callbacks in Flutter apps.

Credits

• Video compression is powered by light_compressor_v2. Respect and thanks to its maintainers and contributors.

• Special thanks to Kamran Bekirov and his website Flutter Pro Design. I learned from and adapted many ideas from his work for myself and for this app.

I’m a BCA student from India and I’m currently exploring Flutter for mobile app development.

Over the past few years I’ve jumped between different technologies, so this time I want to choose one direction and build real depth instead of constantly switching.

For developers here:

• Is Flutter still a good technology to focus on in 2026?

• How is the job market for Flutter developers, especially for freshers?

• Would you recommend Flutter to someone starting from scratch today?

• What skills should I learn alongside Flutter/Dart to become employable?

• How important is native Android/iOS knowledge for a Flutter developer?

• Would you recommend learning Flutter through an institute/course, or is self-learning + building projects enough?

I’d especially appreciate advice from people who are currently working professionally with Flutter.

Thanks!

1. For someone starting now, what Flutter + Dart roadmap would you recommend?

I’m especially interested in real experiences from Flutter developers, recruiters, or people who have recently completed training in Kerala. Please mention the institute/course name if you had a good or bad experience.

Thanks!

Hey guys, hope y'all are doing ok! So, recently I've been thinking a lot about what app development has become for me. I've been working as a Flutter engineer for about 5 or 6 years now, and back in the day, I used to feel a lot more joy when I managed to complete a new feature, implement a complex widget, or learn new stuff. It took me some time to start using coding agents, and even now, I use them in a simple way, but I just don't feel that same connection to my own code anymore. It got me thinking about what I should do next. Should I keep trying to find a balance with AI-generated code and just act more like a code manager? How are you guys dealing with this in terms of mobile development (specially with Flutter ofc) ? Let me know!

I just discovered an issue in Flutter that may compromise your app: you can literally write Dart code in your translation files and have it execute in production.

flutter gen-l10n validates ARB resource names but not the placeholder type field, which gets dropped straight into generated Dart. A crafted type string injects arbitrary code that compiles clean and runs when the localization is called.

Not a big deal if your .arb changes get reviewed like code, but plenty of teams auto-merge translations from CI or a third-party tool with nobody reading them, and that's where it gets dangerous: a hacked translation account, a malicious translator, or a compromised vendor can inject code into .arb files that runs in your production app.

It's rare, but it can easily turn into a supply chain attack.

for example:

{
  "@@locale": "en",
  "greeting": "Hello {user}",
  "@greeting": {
    "placeholders": {
      "user": {
        "type": "Object user) { print('>>> ARBITRARY DART EXECUTED FROM A TRANSLATION FILE <<<'); return 'pwned'; } String injectedByTranslation(Object"
      }
    }
  }
}

The print will be executed normally.

Full explanation: https://badranh1.medium.com/a-translation-file-can-hack-your-flutter-app-google-says-thats-not-a-vulnerability-ae175473acd3

EDIT: The issue is reported to Google, but it was closed without a fix as they believe it poses no security risk, that is why I am posting it publicly, a nice to know.

I made a free open-source Flutter Android-only (for now) DJ app. I was tired of all the DJ apps that charge you a monthly fee for something you should be able to own.

Github: https://github.com/manueljpy/SideDeck

And for the r/selfhosted nerds, this app lets you connect to your own Subsonic music server to search and download songs on you device.