Who contributed to Mobile platforms on June 29, 2026?

4 developers shipped this update, including adilburaksen, robert-ancell, eeckstein, and filip-sakel.

What were the notable Mobile platforms updates?

Verify shader bundle FlatBuffer before access in flutter_gpu ShaderLibrary, [linux] Use GWeakRef for engine and parent in FlAccessibleNode, and SimplifyKeyPath: some improvements and fixes.

Mobile platforms

Flutter, Swift, and Kotlin - the mobile platforms developers ship on

Pick a date

Topics: Mobile Full archive →

The Wire · Showcase

FLUTTER GPU BUFFER EXPLOIT CLOSES, SWIFT OPTIMIZATIONS SHIP

By RepoJournal · Filed 06:04 UTC on June 29, 2026 · About Mobile platforms

4 people shipped this

adilburaksen @adilburaksen 1 cited

robert-ancell @robert-ancell 1 cited

eeckstein @eeckstein 1 cited

filip-sakel @filip-sakel 1 cited

Flutter's GPU shader loader was reading untrusted buffers without verification, the exact vulnerability pattern that just got fixed in two sibling systems.

The flutter_gpu ShaderLibrary parser was checking file identifiers but skipping the critical FlatBuffer verification step before accessing internal offsets, leaving the door open for out-of-bounds reads on corrupted payloads [1]. This mirrors the structural-verification gap that was just patched in Flutter's two other loaders, suggesting a systemic gap in the codebase. On the accessibility front, Flutter's Linux layer had a more subtle memory corruption: FlAccessibleNode was storing weak pointers to the engine and parent on the node itself rather than on the target objects, so the pointers never cleared when targets were destroyed [2]. The AT-SPI bridge can keep nodes alive past engine teardown, making subsequent dereferences fatal. Over in Swift, the compiler team shipped significant optimizer work: SimplifyKeyPath now runs in SILCombine, handles class_method users, and properly inserts compensating destroys to avoid lifetime shortening [3]. The frontend also converted NLOptions to an OptionSet, enabling exposure to ASTGen for upcoming swift-syntax validation [4]. Kotlin's build toolchain tightened up with an update to idea-ext 1.4.1, killing Gradle deprecation warnings that were scheduled to break in Gradle 10 [5].

Action items

→ Review flutter_gpu shader bundle handling in your engine build - apply verification before next release flutter/flutter [immediate]
→ Update Kotlin builds to idea-ext 1.4.1 before next Gradle 9.x usage JetBrains/kotlin [plan]
→ Monitor Swift optimizer changes for edge cases in keypath application apple/swift [monitor]

References

[1] Verify shader bundle FlatBuffer before access in flutter_gpu ShaderLibrary ↗ flutter/flutter
[2] [linux] Use GWeakRef for engine and parent in FlAccessibleNode ↗ flutter/flutter
[3] SimplifyKeyPath: some improvements and fixes ↗ apple/swift
[4] [Frontend] Convert `NLOptions` to an `OptionSet` ↗ apple/swift
[5] [Build] Update idea-ext plugin to 1.4.1 JetBrains/kotlin

Quick answers

What shipped in Mobile platforms on June 29, 2026?: Flutter's GPU shader loader was reading untrusted buffers without verification, the exact vulnerability pattern that just got fixed in two sibling systems. In total, 9 commits and 8 pull requests landed.
Who contributed to Mobile platforms on June 29, 2026?: 4 developers shipped this update, including adilburaksen, robert-ancell, eeckstein, and filip-sakel.
What were the notable Mobile platforms updates?: Verify shader bundle FlatBuffer before access in flutter_gpu ShaderLibrary, [linux] Use GWeakRef for engine and parent in FlAccessibleNode, and SimplifyKeyPath: some improvements and fixes.

KOTLIN COMPILER FIXES ELVIS OPERATOR FALSE POSITIVES, TIGHTENS WASM CACHING

Kotlin's control flow graph just got smarter about dead code detection, eliminating false warnings that have been shadowing real issues.

mobile 29 shipped 1-min read

Mobile platforms 2 days ago

SWIFT MACRO IMPORTS AND KOTLIN CLASS INITIALIZATION FIXES SHIP ACROSS PLATFORMS

Swift's ClangImporter gains APINotes-driven macro customization while Kotlin standardizes NoClassDefFoundError behavior across JVM and native targets.

mobile 22 shipped 1-min read

Mobile platforms 3 days ago

FLUTTER PATCHES WEB GESTURE BUG, SWIFT SIMPLIFIES CODEGEN PATHS

Flutter 3.50 shipped a critical fix for iOS 27 WebKit that was silently dropping tap events, while Swift consolidated scattered CodeGen configuration into a single control point across three major repos.

+11

mobile 147 shipped 2-min read

Mobile platforms 7 days ago

KOTLIN RIPS OUT INTERPRETER GUTS, FLUTTER PATCHES RENDERING PIPELINE

Kotlin is systematically removing its IR interpreter in a multi-commit cleanup that signals a major shift in how the compiler handles intermediate representation, while Flutter ships critical Vulkan safety fixes and expands autofill support.

mobile 115 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.