Require a package:jni version without known buffer overflows

[brianquinlan]

• package:jni 0.7.1 has a potential buffer overflow when converting Java to Dart strings.

---

• I’ve reviewed the contributor guide and applied the relevant portions to this PR.

Contribution guidelines:

• See our contributor guide for general expectations for PRs.
• Larger or significant changes should be discussed in an issue before creating a PR.
• Contributions to our repos should follow the Dart style guide and use dart format.
• Most changes should add an entry to the changelog and may need to rev the pubspec package version.
• Changes to packages require corresponding tests.

Note that many Dart repos have a weekly cadence for reviewing PRs - please allow for some latency before initial review feedback.

[natebosch]

We could publish this, I don't think it will hurt anything, but I also don't think it helps.

This doesn't prevent anyone from resolving the old package (they could get old cronet_http with old jni) and nothing stops projects from dart pub upgrade to get the working versions with the current cronet_http.

What effect is intended with this change?

[brianquinlan]

We could publish this, I don't think it will hurt anything, but I also don't think it helps.

This doesn't prevent anyone from resolving the old package (they could get old cronet_http with old jni) and nothing stops projects from dart pub upgrade to get the working versions with the current cronet_http.

What effect is intended with this change?

I was actually writing you in chat about that... My intent was to provide some signal that people should upgrade and this is the only way that I could think to do it.

I would expect that few people have any version constraints applied to package:jni so they will get the new version automatically.

For people who pin their dependencies, hopefully the CHANGELOG for package:cronet_http is attractive enough to make it seem worthwhile.

But I'm happy to not do a release for this if it won't have any positive effect (checking this code in still seems sensible).

[natebosch]

My intent was to provide some signal that people should upgrade and this is the only way that I could think to do it.

I don't think I would expect this publish to be noticed as sending that signal. Either way a dart pub upgrade is the way to get out of the situation and we need to inform some users about that either way.