Packages with example apps opted-in for null safety fail the null safety checks

[amirh]

This came up in flutter/flutter#69440 (comment) where a bunch of flutter/plugins packages started failing on CI.

@zanderso and @leafpetersen pointed out that the failing packages included example apps with no Dart SDK constraints which means they are treated as opted-in for null safety.

While the flutter/plugins packages are fixed in flutter/plugins#3240 it's somewhat worrying that many other packages in the ecosystem will take a similar hit.

I counted the affected packages across pub and there are currently 725 packages with example apps that are opted-in for null safety (most likely unintentionally as null safety isn't launched yet).

698 of these packages are actually not opted-in for null safety (e.g the root pubspec.yaml isn't opted-in while example/pubspec.yaml is opted in).
For these 698 packages I believe it should be safe to assume that the sdk constraint in example/pubspec.yaml should be intersected with the sdk constraints of the root pubspec.yaml. So it's fairly easy to automate the fix.

The list of the 698 "fixable" packages is available in this sheet.

I'm happy to send PRs using dart_lsc to fix example/pubspec.yaml for as many of these 698 packages as possible.
I guess another alternative to consider would be to somehow teach the analyzer that the example app's sdk constraint cannot be wider than the package's sdk constraint.

cc @mit-mit @csells

[mit-mit]

The root cause here is that when a project doesn't have an SDK lower bound, no language version is written into .dart_tool/package_config.json.

[mit-mit]

Jonas logged https://github.com/dart-lang/pub-dev/issues/4208 for a potential pub change. Please thumbs up/down/comment there for that proposal.

[leafpetersen]

We have reports of users downstream of packages that have no lower sdk constraint getting broken on master. For example, these two packages are broken on master. I see two options here:

• Manually fix up the broken packages on pub (may be difficult to get PRs landed)
• Change the interpretation of missing lower bounds to mean "2.7" instead of "latest".

I think we likely need to do one or the other for beta. cc @franklinyow @jonasfj @natebosch @lrhn @jakemac53 @munificent

[franklinyow]

@leafpetersen
Are you saying that we need additional work in additional to dart-lang/pub#2707?

[amirh]

List of affected packages: https://docs.google.com/spreadsheets/d/1b3zD8TGfl6yxSJF-ZXjzg0hKluY-kXWcIPVF-5hUiME/edit#gid=513901545

[mit-mit]

Discussed in language team, and agreed that:

• Keep the current ERROR when resolving a pubspec that itself is missing one or more parts of the upper/lower Dart SDK constraint
• Add new logic in pub get that for dependencies which do not have a lower constraint in their pubspec, defaults the language version to 2.7, and write that to the package config