[Feature] Dependency freshness and SBOM depth #517

New issue

Closed

opened 2026-07-22 09:28:34 +00:00 by brenno · 0 comments

brenno commented

2026-07-22 09:28:34 +00:00

Owner

Dependency freshness and SBOM depth, from the release review.

Dependencies. dartcv4 is at 1.1.8 against 2.2.1+4 — a full major behind, on the native layer that decodes untrusted image data, so it carries the largest attack surface of the tree. It is held back by opencv_core: ^1.4.5. No known CVE, but "a major behind on the riskiest layer" is a decision, not a default. Smaller ones: uuid, video_player, shared_preferences_android, and wakelock_plus (pinned by a constraint).

SBOM depth. The dependency graph is one layer deep: 46 DEPENDS_ON relations across 200 packages, with 153 packages appearing in no relation at all. SPDX packages carry no supplier field, which is an NTIA minimum element.

A gate that cannot fail. The staleness check reports MIAUW as current because the bundled date is structurally earlier than the probe date — that source can never go red. Either the comparison is wrong or the source needs a different freshness signal.

Any pubspec change requires make sbom and committing sbom/, or sbom_test fails.

Dependency freshness and SBOM depth, from the release review. **Dependencies.** `dartcv4` is at 1.1.8 against 2.2.1+4 — a full major behind, on the native layer that decodes untrusted image data, so it carries the largest attack surface of the tree. It is held back by `opencv_core: ^1.4.5`. No known CVE, but "a major behind on the riskiest layer" is a decision, not a default. Smaller ones: `uuid`, `video_player`, `shared_preferences_android`, and `wakelock_plus` (pinned by a constraint). **SBOM depth.** The dependency graph is one layer deep: 46 `DEPENDS_ON` relations across 200 packages, with 153 packages appearing in no relation at all. SPDX packages carry no `supplier` field, which is an NTIA minimum element. **A gate that cannot fail.** The staleness check reports MIAUW as current because the bundled date is structurally earlier than the probe date — that source can never go red. Either the comparison is wrong or the source needs a different freshness signal. Any pubspec change requires `make sbom` and committing `sbom/`, or `sbom_test` fails.

brenno added the

enhancement

accepted

labels

2026-07-22 09:28:34 +00:00

brenno referenced this issue from a pull request that will close it,

2026-07-22 12:01:53 +00:00

feat: volledige afhankelijkheidsgraaf, supplier-veld, en een verouderingspoort die kan falen #545

brenno closed this issue

2026-07-22 12:01:55 +00:00

brenno referenced this issue

2026-07-22 13:44:01 +00:00