Sdk: Current core packages don't work with pub on Dart 2.12 and sound null safety

[mit-mit]

The current published core packages don't work with sound null safety in Dart 2.12:

1. They use upper constraints like <2.12.0 which causes confusing pub warnings
2. They use lower constraints like >=2.10.0-78, which pub interprets as not opted into null safety

Repro steps:

1. Update to latest Dart/Flutter master SDK
2. dart create repro
3. cd repro
4. Update pubspec.yaml to have SDK constraint: sdk: '>=2.12.0-0.0 <3.0.0'
5. Update pubspec.yaml to not have a dependency on pedantic
6. dart pub get

7. dart --sound-null-safety run => Runs as expected

8. Edit pubspec.yaml and add a dependency:

   dependencies:
     collection: ^1.15.0-nullsafety
   

9. dart pub get

Issue 1: Upper bound warning

pub get prints:

Resolving dependencies... (1.1s)
Overriding the upper bound Dart SDK constraint to <=2.12.0-3.0.dev for the following packages:

collection

To disable this you can set the PUB_ALLOW_PRERELEASE_SDK system environment variable to `false`, or you can silence this message by setting it to `quiet`.
> collection 1.15.0-nullsafety.4 (was 1.14.13)

issue 2: Sound null safety is disabled:

pub get prints:

The package resolution is not fully migrated to null-safety.

package:collection is not opted into null safety in its pubspec.yaml:
  ╷
8 │   sdk: '>=2.10.0-78 <2.12.0'
  │        ^^^^^^^^^^^^^^^^^^^^^
  ╵

Either downgrade your sdk constraint, or invoke dart/flutter with
`--no-sound-null-safety`.

[mit-mit]

I think this is a beta blocker from a core user journey experience PoV, cc @leafpetersen @franklinyow

[devoncarew]

Moving to area-library for the triage process (but this is likely logically in something like area-packages).

[franklinyow]

@jakemac53 @natebosch FYI

[mit-mit]

Versioning proposal:

Versioning during null safety beta

Packages published after beta, but before stable, should follow these versioning guidelines:

1. Package version must be a pre-release version (docs), using nullsafety as the suffix (e.g. 2.0.0-nullsafety.0)

2. Package version must be a major version increment of the most recent stable version on pub.dev (e.g., if most recent stable version is 2.4.0, publish first null safety version as 3.0.0-nullsafety.0). If your package has not already reached 1.0.0, then the package version should be a minor version increment. So if the most recent stable published version is 0.2.4, your first null safety version would be 0.3.0-nullsafety.0.

3. Subsequent updates to the null safety version of the package are handled by incrementing the pre-release suffix p in x.y.z-nullsafety.p (e.g., if first null safety version is 3.0.0-nullsafety.0, use 3.0.0-nullsafety.1 for the next null safety version)

4. Should use an SDK constraint that allows Dart 2.x SDK releases. This ensures packages published during beta still work once we cut the stable build, and gives developers some time to publish new stable versions. For example, if the trial migration was done with Dart SDK version 2.12.0-18.0.beta, use:

   • A lower constraint matching the SDK version that was used for the migration, e.g.
     sdk: '>=2.12.0-18.0.beta<3.0.0'

   • An upper constraint that allows 2.x SDKs, e.g.
     sdk: '>=2.12.0-18.0.beta<3.0.0'

Versioning after null safety stable

As above, except packages can now be published as stable versions (as opposed to pre-release versions) on pub.dev.

[jakemac53]

Just to be clear, these packages do work perfectly fine. All compilers and runtimes correctly interpret and run them.

The pub tool does give some erroneous warnings, and doesn't properly implement language versioning, causing some potentially confusing warnings etc.

We are planning on re-publishing the core packages using the versioning guidelines listed above this week in order to work around these issues.

[mit-mit]

characters was just published in a version with constraints sdk: ">=2.12.0-0 <3.0.0". I confirmed that this works with current pub:

$ cat pubspec.yaml
name: repro4

environment:
  sdk: '>=2.12.0-0 <3.0.0'

dependencies:
  characters: ^1.1.0-nullsafety

$ dart pub get
Resolving dependencies...
+ characters 1.1.0-nullsafety.5
Changed 1 dependency!

cc @natebosch @jakemac53, thanks!

[leafpetersen]

The pub tool does give some erroneous warnings, and doesn't properly implement language versioning, causing some potentially confusing warnings etc.

Is there an issue open for discussion the possibility of fixing this longer term?

[mit-mit]

@kevmoo did you update repomanager to be able to track where we are at wrt. these being published?

[jakemac53]

Is there an issue open for discussion the possibility of fixing this longer term?

It was closed https://github.com/dart-lang/pub/issues/2621

[franklinyow]

It's not clear what's left to resolved this. Since flutter #69770 is dependent on this, we should try to unblock that work.

[jakemac53]

As far as I know this can be closed, all the core packages have been republished with the new constraints to the best of my knowledge.