why is google_maps_flutter_web not null-safe?

[jonasfj]

https://pub.dev/packages/google_maps_flutter_web/score

[jonasfj]

Is that a similar problem with: https://pub.dev/packages/supabase_flutter/score

Maybe, we should look through results from: https://pub.dev/packages?q=-is%3Anull-safe&sort=updated&page=1

[isoos]

The root cause seems to be that some Dart SDK libraries are not available on Flutter SDK, e.g. dart:web_gl in this case. package:google_maps_flutter_web depends on package:google_maps, and the later is able to import dart:web_gl. Because package:google_maps is a generic package, and it is analyzed with Dart SDK, pana is successful identifying it as null-safe. However, package:google_maps_flutter_web is analyzed with Flutter SDK, and in the transitive import path it ends up importing dart:web_gl, which is not available, therefore the analysis fails.

For package:supabase_flutter it is the same thing happening with package:hive and dart:indexed_db.

A quick fix could be to allow-list Dart SDK libraries that are missing from Flutter SDK, and if they are imported via a transitive dependency, we don't fail the analysis.

Another fix could be to restructure the current null-safety detection code. If I understand it correctly, we are iterating over Runtime.recognizedRuntimes and require for each that all public libraries have accessible and null-safe dependencies. https://github.com/dart-lang/pana/blob/master/lib/src/tag/tagger.dart#L388-L435

Instead, we could do the following changes:

• (1) If there is any runtime that is accessible and with null-safe dependencies, then we grant the tag.
• (2) If the package uses Flutter, we also check the Runtime.flutterNative and Runtime.flutterWeb runtimes. (and maybe add the allowed dart: libraries to an allow-list and exempt them to be accessible)

/cc @jonasfj @sigurdm wdyt?