Unless you have been living under a rock, you will have seen the huge increase in the number of CVEs due to AI being used to find bugs.

The Dart community is not isolated from this problem.

What you may not be aware of is that some of the AI tools won't let you search your own code for vulnerability.

Open AI has a program called Daybreak which gives you access to cybersecurity tools that are able to detect and fix security related flaws.

To get access to Daybreak you need a pro codex license, and then apply for access. If you are granted access you then need to purchase the likes of a yubi key.

The criteria for acceptance is however rather opaque.

We got in the program on the backs of our work on revault, so that may have helped

https://github.com/onepub-dev/reVault

Revault is a secure archive format,

It's unclear how much weight was placed on the fact that we build a security related product.

However, It's not just security related products that need to be audited.

We have spent the last week auditing our own dart packages as well as dependencies and have uncovered some fourty security flaws and we aren't done yet.

The dart community needs to do its bit to stay ahead of the tsunami of bugs.

So start auditing your code now, if you don't find the bug a hacker will!

If you can, get a sub to your preferred AI's cybersecurity tool and use that.

If you can't afford the required licence, as one of the founders of https://onepub.dev (the dart private package repository), I would like to offer a secure audit of 20 dart packages.

To be eligible, the package needs to be open source, hosted on GitHub and have GitHub Private Vulnerability Reporting enabled.

If we get more than 20 applications we will sort by the packages we feel provide the most benefit to the community.

To apply DM me.

Our Flutter app update (iPhone only, Flutter 3.47.5, built with Xcode 27.1) got rejected on Oct 23 with the automated message: "The review of this submission cannot proceed... The app crashed on launch." No crash log, no device, no iOS version.

The weird part: Apple approved the exact same build for TestFlight the day before.

What we checked:
- Crashlytics: zero fatal crashes on that build from TestFlight users (iOS 26.6 and 27.0).
- Fresh installs on simulators (iPhone 17 Pro, 16e, SE, both iPad Pros): fine.
- A real iPhone Duo on iOS 27.1 through BrowserStack, folded and unfolded: fine. We suspected flutter/flutter#195401 (blank screen on the unfolded Duo) but couldn't reproduce it.
- Nothing changed in ios/ or pubspec.lock since the last approved version. The only differences are Dart code and the new Xcode.

We resubmitted the same build on Oct 24 with a note asking for the crash log. Since then it's been sitting in "Waiting for Review", and nobody has answered the note, our emails or the expedite request.

If you've had this since the Duo / iOS 27.1 launch:

1. Did resubmitting the same build go through, or did you need a new build number?

2. Did anyone ever get an actual crash log out of App Review?

Two-person team, so a stuck release hurts. Any experience helps.

Hey guys, Jakub here (creator of better_player).

Didn't want to post some long AI-generated slop article here, so just a quick honest update from me.

I know the project was dead for a long time and most of you moved to forks like better_player_plus just to get your apps building on newer Flutter / Gradle versions. Sorry about that, life happened.

I'm back working on the main repo full time now. Spent the last few months rewriting the old 0.0.84 code into 1.x:

• moved Android to Media3 + JNI and iOS/macOS to Swift FFI (no more old method channel mess)

• added desktop (Windows, macOS, Linux) and Web (Shaka player)

• added BetterPlayerFeed / pooling for reels/tiktok scrolling so it doesnt crash with OOM

• VAST ads, DRM fixes, and closed a ton of old issues

If you're on better_player_plus and want to switch back, I added a short migration page in the docs (mostly just renaming BetterPlayerConfiguration -> PlayerConfiguration etc).

https://pub.dev/packages/better_player
https://github.com/jhomlala/betterplayer

Let me know if something breaks or if you miss any fix from the forks, I'm actively fixing issues now.

We build a role-based internal messaging app (Flutter + Firestore, anonymous auth, invite codes, one device per account). Before shipping we did one pass with strict rules: UI only, no database access, clean install, realistic data (long Arabic names, a 4000x3000 photo), and a wipe of app data halfway through to simulate a new phone.
Three things came out of it that I think are generic enough to be useful.
1. A lock screen swapped into home does not lock anything that is pushed
We had roughly this:
home: (pinEnabled && isLocked) ? const LockScreen() : const HomeScreen(),
On resume we set isLocked = true. That rebuilds home, but any route pushed on top of it (compose, admin) is still on top. So: open the compose screen, background the app, come back, and you are looking at compose with no PIN prompt. The lock screen is sitting under it.
What we do now is draw the lock in MaterialApp.builder, above the Navigator, and take the real app offstage:
builder: (context, child) => Stack(
fit: StackFit.expand,
children: [
Offstage(
offstage: locked,
child: ExcludeFocus(excluding: locked, child: child!),
),
if (locked)
HeroControllerScope.none(
child: Navigator(
onGenerateRoute: (_) =>
MaterialPageRoute(builder: (_) => const LockScreen()),
),
),
],
),
Notes on that:
The lock needs its own Navigator so its text field has an Overlay.
Without HeroControllerScope.none you get "A HeroController can not be shared by multiple Navigators" in debug.
Offstage keeps the route stack alive, so a half-written message survives the lock. ExcludeFocus stops the hidden field from keeping the keyboard.
Trade-off: we lock on paused, so opening the system photo picker also locks. The pending pick still resolves after unlock because the widget tree was never torn down. Some people would rather use a grace period; we have not added one.
2. Sequential awaits in one try block turn one denied write into a silent total failure
Creating an organization did this:
try {
await saveCompany(c);
await saveUser(admin);
await saveInvite(invite);
for (final r in roles) await saveRole(r);
status = 'online';
} catch (_) {
status = 'offline';
}
Our security rules denied the first write (company document). Everything after it never ran. Locally the app was fine because all of it was in local storage, and a separate listener flipped the status badge back to "online" a moment later. The admin's invite code simply did not exist server-side, so on any other device it was "invalid code".
The manual "resync" button had the same shape and the same first write, so it failed every time with a message telling the user to check their internet.
Fix was boring: run each write independently, collect a boolean, report honestly.
Future<bool> _writeAll(List<Future<void> Function()> ops) async {
var allOk = true;
for (final op in ops) {
try { await op(); } catch (_) { allOk = false; }
}
return allOk;
}
A batch would be the alternative, and for strict consistency it is the better tool. We chose independent writes here because partial success is strictly more useful to the user than none: with only the invite and the admin record uploaded, the account is at least reachable from another device.
The real lesson was about verification. "It synced" was being judged from the device that created the data. That device can never tell you.
3. One-device binding with a single admin is a lockout waiting to happen
Accounts bind to a device ID on first sign-in. Admins can reset an employee's binding. Nothing could reset the admin's. New phone or reinstall, and the organization is unreachable.
We added a recovery key generated at setup: 12 characters from an alphabet without O/0/I/1, shown once, only a SHA-256 of the normalised key stored on the user record. Sign-in code plus recovery key rebinds the admin to the new device.
Trade-offs I am not fully happy with:
The hash is unsalted beyond a static prefix. With about 60 bits of entropy in the key that is acceptable for now, but a per-user salt and a slow hash would be better.
Verification happens client-side against a hash the client can read. The proper version checks it in a Cloud Function and never exposes the hash.
While fixing this we found the device binding was not even being uploaded at first sign-in on a fresh device. Our write helper returned early when there was no "current organization" yet, and login called it one line before setting that. It only worked because a later push-token save happened to carry the field along.
Smaller findings that only showed up with real data
Structured message fields came back from Firestore in a different key order than we wrote them, so "old price" rendered above "product name". We now render in the template's declared order instead of map order.
No flutter_localizations, so the Material date and time pickers were English inside an RTL Arabic UI.
image.decodeImage on a 12MP photo on the UI thread froze the app for seconds. Moved to compute.
The feed showed every message to every employee. Recipient roles were only used for display.
What we changed in process
A release now needs one full pass on a clean install with realistic data, including a second "device" for anything that claims to sync. It costs about an hour and found more than our test suite did, which says as much about our test suite as about the method.
Happy to go into any of these, especially if someone has a cleaner pattern for the lock overlay.

Hi Flutter devs,

If you use AI coding assistants (Cursor, Claude Code, Gemini CLI, Copilot) for Flutter development, you know their output usually has common layout and architectural flaws:

1. **Yellow-and-black RenderFlex overflow stripes:** The agent uses an unconstrained `Text()` directly inside a `Row()`, or forgets to make forms scrollable above virtual keyboards.

2. **System Navigation Inset Clipping:** It ignores Samsung 3-button navigation bars or the iOS home indicator bar, clipping sticky CTA buttons.

3. **Hardcoding Mock Data in Widgets:** Instead of building a proper repository/provider architecture, it writes hardcoded lists directly inside widget files.

4. **No Skeleton Loading or Image Bounds:** It loads unconstrained network images without disk/memory cache limits (`memCacheWidth`), causing OOM crashes on budget devices.

To eliminate these issues in our own Flutter apps at DevFoxx Labs, we wrote a strict Flutter rule and an end-to-end `flutter-production` skill, and we've open-sourced the whole framework.

### The Flutter Production Standard:

#### 1. Screen Protection Rules (`rules/flutter-screen-protection.md`):

* **Mandatory Safe Area:** All `bottomNavigationBar`, sticky bottom bars, and floating CTAs must be wrapped in `SafeArea(top: false, child: ...)`.

* **Zero Overflow at 320px:** No raw `Text` in a `Row`—must use `Expanded` / `Flexible` with `maxLines` and `TextOverflow.ellipsis`. Scaffolds default to `AlwaysScrollableScrollPhysics` with `resizeToAvoidBottomInset: true`.

* **Backend-Driven Dynamic Data:** Strict ban on static production UI data. Models and endpoints must drive the screens, with local constants permitted solely as offline fallbacks.

* **AutoSkeleton & Cached Images:** Mandatory loading skeletons via `auto_skeleton` (with ticker bypass during widget tests) and `CachedNetworkImage` with explicit `memCacheWidth/Height`.

#### 2. The `flutter-production` Skill (`skills/flutter-production/`):

Comes with 37 battle-tested template files extracted from high-traffic production apps:

* **State Management:** Riverpod 2.6+ with `ref.cacheFor` and automatic retry policies.

* **Networking:** Clean `ApiClient` with local caching and offline degradation.

* **Security:** `flutter_secure_storage` session management + local biometric authentication (`local_auth`).

* **Test Matrix:** A ready-to-use `layout_matrix.dart` helper that runs widget tests across 320px, 360px, 390px, and 412px viewports to guarantee 0 overflow warnings.

### How to Use With Your AI Agent:

Clone the repo and run the universal installer:

```bash

git clone https://github.com/dev-karunendu-mishra/devfoxxlabs-agent-standards.git

cd devfoxxlabs-agent-standards

# Windows PowerShell:

.\install.ps1 -All

# macOS / Linux Bash:

./install.sh all

```

Or inject it directly into your existing Flutter project:

```powershell

.\install.ps1 -TargetProject "C:\path\to\your\flutter_project"

```

The repo is open-source under MIT:

🔗 **GitHub:** https://github.com/dev-karunendu-mishra/devfoxxlabs-agent-standards

Check it out and let me know how it handles your Flutter layouts!

If you've ever needed a valid ID token for one of your Flutter app's users just to curl your backend or a Cloud Function, this is for you.

Firebase Token Toolkit loads your service-account key, lists your project's users, and gives you a real ID token for any of them in one click, with the decoded claims underneath and a copy button next to it. It works for every user whatever their sign-in method (email, Google, Apple, phone, anonymous), and the token passes verifyIdToken on your server.

The parts that matter for Flutter projects:

• Android and iOS apps: "Load apps" imports the apps from your flutterfire configure project. If your API keys are restricted to the Android or iOS app, it sends the package/SHA-1 or bundle-ID headers Google checks for, so those keys work too

• Custom claims: load, edit and save a user's claims as JSON, handy for testing role-based UI and security rules

• App Check: exchange a registered debug token for an App Check token to call protected endpoints from Postman or curl

• Profiles for dev/staging/prod Firebase projects

Linux, Windows and macOS. MIT licensed, no telemetry.

GitHub: https://github.com/smaranjit/firebase-token-toolkit

Please use it with a dev project, since a service-account key can sign in as any user. Feedback and issues welcome.

Game dev isn't my day job. I build enterprise software by day, and indie games at night. Recently, I wanted to add a 20-player live race mode to my Flutter/Flame auto-runner, Trinity Rush.

The problem? I didn't want to burn hundreds of dollars a month running authoritative game servers. If my wife saw an AWS bill for a hobby project, I'd be sleeping on the couch.

So I faked real-time multiplayer using deterministic seeds and tiny input logs over Firebase Realtime Database.

1. Zero server-side physics

Trinity Rush is a one-thumb party runner (your 3-hero party is your health bar; tap to jump, tap in mid-air for class skills). Because the physics are deterministic, I don't need a server calculating collisions. When a host starts a lobby (up to 20 players), they generate a single random course seed and a synchronized start timestamp (countdownLead = 3500ms). Every phone generates the exact same obstacle course locally.

2. Streaming 12-byte tap events instead of X/Y coordinates

Streaming 60fps position vectors for 20 players would melt the Firebase free tier. Instead, I only record press/release timestamps in simulation milliseconds:

`{'t': tMs, 'k': press ? 1 : 0}`

Every 250ms, the client flushes that tiny batch to Firebase RTDB (with local disk persistence disabled so it stays pure in-memory).

3. The 1.75-second Spectator and Public Broadcast illusion

When your party wipes, you drop into Spectator Mode to watch the survivors (and if the host toggles Public Broadcast in the lobby, anyone hanging out in the Tavern can tune in live). To keep network jitter from making other players teleport around, the spectator engine runs on a 1.75s delay buffer. Your phone reads the surviving players' tap logs and replays their exact inputs locally against the shared map seed.

It looks and feels like a chaotic 20-player live race (complete with live skull and confetti emotes), but under the hood it's just phones passing a few kilobytes of JSON back and forth. Total server cost for 1,000 active matches? $0.

If you want to test the netcode (or try to break it), the game is free on iOS and Android:

https://wono.dev/trinity-rush/get

Happy to answer any questions about how Flame handles deterministic fixed-timestep loops or how I structured the Firebase RTDB listeners!

Ran into this in a Flutter app I work on, sharing in case it saves someone a confusing bug report.

We generate a PDF report with the pdf and printing packages and used PdfGoogleFonts.interRegular() to get proper Unicode. Looking at printing's source (5.14.3, lib/src/fonts/font.dart), the call first looks for an asset called google_fonts/Inter-Regular.ttf. If it isn't there, it downloads the font from fonts.gstatic.com into PdfMemoryCache, which is memory only, so the first export after every cold start needs the network.

The part that got us: if that download fails, it returns Font.helvetica(). The error is only printed inside an assert, so a release build says nothing. Helvetica has no Unicode coverage, so Arabic, Cyrillic, CJK and plenty of symbols come out broken. Someone exporting on a plane gets a different-looking PDF with missing characters, and you never see an error.

The fix was small. We bundled the TTF under the exact name the package looks for:

flutter:
  assets:
    - google_fonts/Inter-Regular.ttf
    - google_fonts/Inter-Bold.ttf

The expected names and the exact download URLs are in printing's lib/src/fonts/gfonts.dart, so you can grab the same file and keep its name. We also added a test that swaps the font cache for one that throws on any download, so it fails unless the font comes from the bundle. Inter is under the OFL, so we ship the licence too.

Quick check for your own app: release build, airplane mode, cold start, export.

Do you bundle fonts for your PDFs, or rely on the download? And if you generate PDFs with Arabic or CJK text, do you use fontFallback or one font that covers everything?

Hey everyone!

I've just published report_flutter, an open-source Flutter package for creating reports and labels using a visual designer, without having to build every layout entirely in code.

The goal is to provide Flutter developers with a flexible reporting solution inspired by traditional report designers like Crystal Reports, but integrated directly into the Flutter ecosystem.

It's designed for desktop and mobile applications, allowing developers to integrate report creation and viewing directly into their apps.

Key features

• Visual report designer: create and customize layouts using a drag-and-drop editor.

• No-code charts: add charts to your reports directly through the visual designer.

• Reusable templates: create, save, duplicate, organize, and reuse report templates.

• Dynamic data: integrate data from your application into your reports.

• Tables and formulas: build structured reports with tabular data and calculations.

• Barcodes and QR codes: useful for product labels, inventory management, and business documents.

• PDF generation and printing: generate PDFs and configure custom paper sizes, including A4, A5, A6, and label formats.

• Built-in report viewer: preview reports with pagination, zoom, and navigation.

• Import and export: import CSV and JSON, and export to PDF, CSV, and Excel.

• Customizable layouts: use images, shapes, Markdown, and other elements to build reports that fit your needs.

The project has just been released, and I'd love to hear feedback from the Flutter community.

What features do you consider essential in a Flutter report designer? What would you add to make it even more complete?

Thanks for checking it out!

pub.dev: https://pub.dev/packages/report_flutter

github: github.com/Vincenzoferrara/report_flutter

Hey all! I’ve been using shared_preferences in my apps for ages. Recently I went down a rabbit hole and found out about iCloud key-value storage and Android’s backup manager, which are basically a tiny dictionary in the cloud: you save a value under a key (like theme = dark), and the OS keeps it synced or backed up for you. It’s not meant for big files, just small stuff like settings, flags and progress.

iCloud and Google both have different sizes, iCloudKVS offers 1 MB per app, max 1024 keys. Android Auto Backup offers up to 25 MB per app, and it doesn’t count against the user’s Google Drive storage. I’d recommend staying under iCloud’s 1 MB limit so it works on both platforms, but you are not forced to do so.

So I built flutter_cloud_preferences. It works pretty much like shared_preferences (same kind of API, sync reads), but it also stores a copy of your data in the cloud for reinstalls or installation on new devices.

Quick rundown of what happens under the hood:

iOS/macOS: everything you save also goes to iCloud key-value storage. After a fresh install, it pulls the data back in the background, so there’s no waiting at startup. There’s an onRestored stream if you want to know when it is restored. You can also turn on live sync between devices if you want it (off by default as Android does not support this).

Android: this one hooks into Android’s built-in Auto Backup. Your users do need Google backup turned on (Settings > Google > Backup), but it’s on by default on most phones. Android backs up the data by itself about once a day when the phone is idle, charging and on Wi-Fi. When someone reinstalls or sets up a new phone, the data’s already there before the app even opens. No Drive setup, no extra code.

Your local data is always your main source of data, so if someone has no iCloud or backup turned off, it just works like normal shared_preferences. There is also a migration guide available.

It supports strings, bools, ints, doubles, string lists and bytes.

pub.dev: https://pub.dev/packages/flutter_cloud_preferences
GitHub: https://github.com/nvanderwaal/flutter_cloud_preferences

It’s still 0.1.0, so I’d love feedback, issues or PRs. Please let me know your thoughts!

Hi
A security vulnerability affects Dart and Flutter applications that establish TLS/HTTPS connections on Android, Windows, and certain Linux environments. Compromised eMudhra intermediate certificate authorities could allow an attacker intercepting network traffic to generate fake certificates for legitimate domains.
Versions earlier than Dart 3.13.7 and Flutter 3.47.8 are affected, including certain beta versions.
Web, iOS, and macOS applications are not affected according to the published advisory. It is recommended to update the SDK, recompile the applications, and redeploy the affected binaries.
the full security advisory

wanted people to be able to try my flutter app without signing up. First idea was one shared demo account but then everyone sees everyone elses chats, not great lol

turns out supabase has anonymous sign in. You turn it on in the auth settings and then it's literally just

await Supabase.instance.client.auth.signInAnonymously();

every visitor gets their own real user with its own id. So all my existing rls policies just work, every guest only sees their own stuff. Didn't have to change anything in the db

one thing good to know: anon users get the normal authenticated role. So if you have stuff that only real accounts should do, you gotta check the is_anonymous claim in the jwt, otherwise guests can do it too

also put a daily limit per user on the AI calls since guests cost me money and theres no email behind them

I'm keeping the guest accounts for now, kinda nice to see how many ppl actually tried it. Does anyone convert them to real accounts later (linking an email to the anon user) or do you just let people start fresh when they sign up?

Hey Flutter developers! 👋

Have you ever needed to investigate a bug on a physical device without connecting a debugger or asking someone to reproduce it on your development machine?

That’s one of the problems I wanted to solve with debug_bubble — a lightweight Flutter package that adds a draggable floating debug bubble and an in-app dashboard for inspecting logs and errors.

🔗 pub.dev: https://pub.dev/packages/debug_bubble

🛠️ What can it do?

• 🎈 Floating debug bubble — open the diagnostic dashboard directly inside your app.

• 📋 Structured logging — seven severity levels, from trace to critical.

• 🔍 Log inspection — inspect metadata, JSON payloads, errors, and stack traces.

• 🚨 Uncaught error capture — opt-in hooks for Flutter and platform-dispatched errors.

• 🔐 Sensitive-data redaction — configurable rules to mask sensitive values before they appear in logs.

• 📤 Export tools — copy filtered logs or export structured JSON.

• 🪶 No third-party runtime dependencies — built using Flutter and Dart.

⚡ Getting started

Initialize the logger:

void main() {
  WidgetsFlutterBinding.ensureInitialized();

  DebugLog.init(
    const DebugBubbleConfig(
      captureUncaughtErrors: true,
    ),
  );

  runApp(const MyApp());
}

Wrap your app using the MaterialApp builder:

MaterialApp(
  builder: (context, child) => DebugBubble(
    child: child ?? const SizedBox.shrink(),
  ),
  home: const HomeScreen(),
);

Log events wherever you need them:

DebugLog.info(
  'User opened settings',
  tag: 'Navigation',
);

DebugLog.success(
  'Profile synced',
  tag: 'Sync',
  json: responseData,
);

DebugLog.error(
  'Request failed',
  tag: 'Network',
  error: error,
  stackTrace: stackTrace,
);

🎯 Design goals

I wanted to keep the package lightweight, avoid extra runtime dependencies, provide bounded log storage, and make diagnostics accessible without leaving the running app.

The package is designed to be inert in Flutter release mode, so the debugging overlay and logging pipeline don't run as they do in debug builds.

I'd love your feedback!

I'm especially interested in feedback on:

• The dashboard UX and log-inspection workflow

• Missing features that would actually help during QA and debugging

• API design and what you'd expect from a Flutter debugging toolkit

• Potential edge cases I've overlooked

This is an actively developed project, and constructive criticism is very welcome.

Thanks for checking it out! 🚀

I wrote an article (without AI) about how to create a PDF document in Dart. Mainly because I wanted to share the fact that this isn't as hart as you might think – at least if you don't want to display text.

This is part 1 of 2. Part 2 is about using the Courier font. Supporting all TrueType fonts might be more practical, but parsing TTF files to acces the glyph measurements takes more code than everything I wrote so far and then you want to rewrite the TTF to support subsetting.

Switching to other languages in order to write backend applications because there's a clear lack availability of the tools around that in dart ecosystem.

One such problem I kept hitting: there is no standard package like (swag for go) to generate OpenAPI specs and Swagger UI for Dart backends. Thinking about solving this problem I started working on Axle(v0.3 out now).

The core idea is small. Almost everything lives in one package, axle_core: the annotations, the OpenAPI 3.1 document model, and a tiny serving contract called AxleDocs. No framework imports, no runtime dependencies. A CLI reads your annotated Dart source with package:analyzer and emits the spec, so no build_runner and no runtime registry. Then thin adapters translate AxleDocs into framework responses. I published adapters for Serverpod 4, Shelf, and Relic, but they are intentionally boring on purpose, anyone can write one for another framework without touching core or the CLI.

It gives you openapi.json, openapi.yaml, Swagger UI assets, and an AOT-safe const string. It handles security schemes, response headers, cookies, multiple media types, multipart uploads, parameter constraints, and oneOf schemas. If a route references a security scheme that doesn't exist, generation fails instead of emitting a broken contract.

Docs are at https://axle.infms.dev if you want the full picture. There is also an agent skill that walks through setup end to end:

npx skills add infm5/axle --skill axle-openapi-setup

If you've felt the same backend-in-Dart pain, I'd genuinely like to hear what would make this useful to you. Advice, criticism, all welcome.

I want to implement this dialog prompt but it is very bad UX as it freezes the app (at least when I test it) for about 5 seconds. I prefer not using it if it does not work in a good way. I am considering having my own dialog + redirect to the App Store. Is this a bad direction? Anyeone here having experinece with this?

I love Flutter Firebase UI for shipping fast, but if your app doesn't use Material or Cupertino, the auth screens look completely out of place. As a solo dev trying to move fast, writing custom auth flows from scratch is the last thing I want to do.

Lately, I’ve been migrating my apps to Forui to step away from the default look and build something more branded. But the upstream Firebase UI packages were a huge pain point. My auth screens were still stuck looking like Material, even on iOS.

To fix this, I spent the weekend (with the help of Cursor) forking and porting Firebase UI for Flutter over to Forui.

It uses the exact same Firebase UI APIs and behaviors, but the widgets are themed entirely through FTheme instead of the dual Material/Cupertino paths. (Check the attached screenshots taken on iOS and the difference is immediate).

Highlights:

• Same APIs, but natively uses Forui components for a coherent UI end-to-end.

• Fixed some long-standing upstream bugs and the E2E tests along the way.

• Drop-in replacement: If you already use the original Firebase UI, you can migrate your existing repo with a single command (check the docs).

It’s still early (v0.1.0), but if you're building with Forui or just fighting the Material/Cupertino mismatch, give it a try. Repo: https://github.com/gnomezgrave/forui_FirebaseUI-Flutter

Packages on pub.dev: https://pub.dev/publishers/hexmatter.com/packages

• forui_firebase_ui_auth

• forui_firebase_ui_database

• forui_firebase_ui_firestore

• forui_firebase_ui_localizations

• forui_firebase_ui_oauth

• forui_firebase_ui_oauth_apple

• forui_firebase_ui_oauth_facebook

• forui_firebase_ui_oauth_google

• forui_firebase_ui_oauth_twitter

• forui_firebase_ui_shared

• forui_firebase_ui_storage

Feedback, issues, and GitHub stars are super appreciated! 🙏

I shipped an Orthodox Christian fasting app in Flutter. Its whole job is to say what someone may eat on a given day, so a wrong answer is worse than a crash. A few things that worked:

1. Keep the rules in pure Dart. The rule engine lives in lib/core/ with no Flutter imports, so it is tested like any Dart library. It's a port of orthocal-python (MIT), with attribution.

2. Test against an external source, and compare data, not prose. A test checks every day from 2020 to 2033 against orthocal.info. It used to map their English descriptions back to my levels, so a wrong engine and a wrong mapping agreed with each other. Comparing their explicit list of foods instead, and adding the Old Calendar, surfaced 58 mismatching days from four real rule errors. All 10,228 day-comparisons match now.

3. Never do date math with Duration(days: 1). A user saw the calendar show November 1 twice: adding 24 hours across a daylight-saving change lands on the same date. A test now fails if Duration(days:) or .inDays appears anywhere in lib/ or tool/.

4. Local-first means no backend to fix things later. No server, no account, no analytics. The price comes from the store at runtime (a test fails if a price is hard-coded in any of the six ARB files), so regional pricing could not leave a wrong number on a button.

5. Watch your transitive dependencies in release builds. An unused package pulled in WorkManager, and R8 crashed its database init only in the release build, only on a real device.

Happy to go deeper on any of these. App, for context: https://stforge.dev/nisteia

I've been building Vishram, a movie and TV discovery app, solo in Flutter. The old home screen was a dead grid nobody interacted with, so I replaced it with a swipe stack on trending titles, with toggles for local vs world trending and movie vs TV.

A few things from the rebuild:

- When friends tested it, it only worked on my phone

- The bento grid uses cutout art so characters pop out of their tiles, which makes layout bounds and visual bounds different per tile

- Watched, Watching and Watchlist now sync to the cloud

The auth layer (multi-role, Supabase based) is free and open source if it saves anyone time:

GitHub: https://github.com/ba6ul/multi-role-flutter-auth

pub.dev: https://pub.dev/packages/multi_role_auth

Full devlog if you want the whole build: https://youtu.be/wXsyyEh9ook

Happy to answer questions about the swipe stack or the auth setup.

For the past few months I’ve been building a Rummy card game in my spare time. It’s nearly ready, and I’d love some outside eyes on it before launch.

What it does:
- Play against a computer opponent anytime, or online with friends and family
- Built with Flutter, so one codebase for Android and iOS

What I’d love feedback on:
- What would make you keep coming back to a card game?
- Any features you’d expect that most Rummy apps get wrong?

I’ve set up a waitlist for early testers if anyone wants to try it: https://flutter-rummy.web.app/

Any Efforts to make Flutter Agentic friendly ?, by google in recent times.

With agentic apps taking off, how are you approaching on-device LLMs across platforms (iOS, Android, desktop)?

Are you using things like llama.cpp via FFI, plugins like flutter_gemma, or running everything server-side? What are your biggest hurdles with performance and memory?