[objectbox_generator] Upgrade cryptography

[ziadsarour]

Is there an existing issue?

• [x] I have searched existing issues

Use case

Because cryptography >=2.0.0 <2.1.0 depends on js ^0.6.3 and cryptography >=2.1.0 <2.6.0 depends on js ^0.6.2, cryptography >=2.0.0 <2.6.0 requires js ^0.6.2. And because cryptography >=2.6.0 depends on js ^0.6.7, cryptography >=2.0.0 requires js ^0.6.2. And because objectbox_generator 4.0.0 depends on cryptography ^2.0.5 and mixpanel_flutter >=2.3.0 depends on js ^0.7.1, objectbox_generator 4.0.0 is incompatible with mixpanel_flutter >=2.3.0. So, because app depends on both mixpanel_flutter 2.3.1 and objectbox_generator 4.0.0, version solving failed.

Proposed solution

Upgrade cryptography that is using a newer version of js

Describe alternatives you've considered

Downgrading Mixpanel to 2.2.0 for now

Additional context

cryptopgrahy is used by objectbox_generator

[greenrobot-team]

Thanks! However, the current version constraint does allow the latest version of cryptography (currently 2.7.0). No?

https://github.com/objectbox/objectbox-dart/blob/045460fe170e6b808d6523c662a97886ec873c66/generator/pubspec.yaml#L23

Maybe try to use flutter pub upgrade instead of editing versions in pubspec manually?

[techouse]

I've made a PR https://github.com/dint-dev/cryptography/pull/181 for that over a month ago, but it's not been merged yet. Until it's merged you can either reference the PR directly or just use dependency overrides, i.e.

dependency_overrides:
  js: ^0.7.1

[greenrobot-team]

@techouse Thanks! So this is nothing that can be fixed by this library. Closing then.

[techouse]

@greenrobot-team sadly https://github.com/dint-dev/cryptography looks abandoned. Maybe think of a drop-in replacement?

[greenrobot-team]

@techouse Thanks for the hint! Last update in September 2023, so would not go that far. Anyhow, had a quick look and I don't really see any good alternatives. Suggestions are welcome!

[greenrobot-team]

Reopened because we should do something about this as js is apparently commonly used (#643).

Internal issue: objectbox/objectbox-dart#112

The current workaround is to add a dependency override.

[techouse]

@greenrobot-team FYI package:js has been deprecated in favour of package:js_interop so the dependency override won't work indefinitely. 🙈

[greenrobot-team]

Release 4.0.3 has switched to the pointycastle crypto library. It allows recent versions of js, so the any dependency override can be removed. It also has migrated to js_interop internally already, so will likely drop the js dependency with a future release.

To update to this release, for a Flutter project run flutter pub upgrade or for a Dart Native project dart pub upgrade.