A security release has at least three separate checkpoints: the vulnerability is documented, the build uses a patched SDK, and users receive the new artifact. A release note is evidence for the first checkpoint; it is not proof of the other two.
The October 23 Dart SDK advisory GHSA-frr6-h895-5pxp identifies Flutter 3.47.8 and Dart 3.13.7 as fixed stable versions for a TLS trust issue involving compromised eMudhra intermediate CA certificates. A Juejin developer report, published October 26, brought the update into ThreadEast’s October 28 reading selection.
Here is a compact record a release owner can keep:
- 1.
Scope record: list the target operating systems and the actual networking path. The advisory describes Android and Windows dart:io behavior and Linux environments whose certificate bundle has not received the trust update. It says Web, iOS and macOS are not affected by this specific issue.
- 2.
Build record: save the Flutter revision, Dart version, source commit and dependency lockfile digest from CI. Rebuild the affected platform artifacts. Updating a local SDK does not change an executable already distributed.
- 3.
Distribution record: save the new artifact digest and the app version that carries it. For a Linux container, also record the base image and certificate bundle. Check any custom certificate-validation override rather than assuming the default verification path is still in use.
This is a source comparison and release-planning checklist. We did not reproduce the exploit, inspect an app’s traffic or measure adoption. The selected listing was captured at 01:35 China Standard Time on October 28; the advisory itself was published October 23.
Full source-reviewed ThreadEast brief and practical guide:
Official advisory:
https://github.com/dart-lang/sdk/security/advisories/GHSA-frr6-h895-5pxp
Original Juejin developer report: