supabase / supabase-flutter

81%

main: 87%

LAST BUILD ON BRANCH fix/gotrue-token-refresh-races

branch: fix/gotrue-token-refresh-races

CHANGE BRANCH

x

Reset

Sync Branches

• fix/gotrue-token-refresh-races
• chore-review-actions
• chore/add-agents-md-file
• chore/adopt-null-aware-elements
• chore/avoid-passing-async-when-sync-expected
• chore/await-futures-lint
• chore/bump-actions-ref
• chore/bump-app_links
• chore/bump-melos-8.2.0
• chore/bump-min-dart-3.9
• chore/bump-min-sdk-3.4
• chore/bump-supabase-flutter-min-flutter-3.32
• chore/cleanup-dead-code-simplifications
• chore/cleanup-readmes-headers-foreach
• chore/code-reference
• chore/coverage
• chore/coverage-realtime
• chore/coverage-source
• chore/enable-avoid-default-tostring
• chore/enable-avoid-self-compare
• chore/enable-avoid-shadowing
• chore/enable-correct-json-casts
• chore/enable-dcm-dispose-class-fields
• chore/enable-dcm-easy-batch
• chore/enable-dcm-lints-tier1-2
• chore/enable-fatal-infos
• chore/enable-misused-test-matchers
• chore/enable-nullable-rules
• chore/enable-single-violation-rules
• chore/enable-small-safe-batch
• chore/fix-typos
• chore/functions-coverage
• chore/gotrue-coverage
• chore/issue-form-platform-all
• chore/issue-form-templates
• chore/pub-workspaces-melos-8
• chore/publish
• chore/realtime-test-first-instead-of-index
• chore/release
• chore/remove-useless-tests
• chore/rename-cond-platform-getters
• chore/replace-parse-ignore-with-internal
• chore/setup-release-please
• chore/silence-supabase-flutter-test-logs
• chore/speed-up-ci-pipeline
• chore/storage-test-inferrable-type
• chore/supabase-coverage
• chore/test-coverage
• chore/test-proper-matchers
• chore/update-examples
• chore/upgrade-app-links
• chore/version-2.16.0
• ci/drop-publish-dry-run
• ci/extract-app-builds
• ci/imgproxy
• ci/melos-publish-no-dry-run
• ci/melos-publish-oidc-token
• ci/melos-publish-yes
• ci/release-tag-app-token
• ci/storage
• claude/agitated-dewdney-0268b3
• claude/frosty-snyder-1b2f48
• claude/mystifying-cerf-7d866b
• claude/naughty-wright-f4fec3
• claude/recursing-williamson-f3d62d
• cleanup/remove-parens-fromJson
• copilot/sub-pr-1327
• dcm-baseline
• dcm-pipeline
• docs/error-codes
• docs/fix-infra-typo-license-20250902-024002
• docs/google-signin
• docs/on-auth-state-change-error-handler
• docs/pub-dev-logo
• docs/update-signinwithidtoken-providers-1259
• etienne/sec-666-pin-all-github-actions-to-full-commit-sha
• examples-passkeys
• feat-admin-oauth-update-list-19ca1
• feat/abort
• feat/add-examples-project
• feat/add-force-function-region-query-param
• feat/broadcast-replay-support
• feat/cupertino
• feat/custom-metadata
• feat/default-debug-off-in-tests
• feat/facebook-sdk-example
• feat/gotrue-get-claims
• feat/gotrue-oauth-server-authorization-api
• feat/gotrue-passkeys
• feat/gotrue-sign-out-reason
• feat/issue-1158-debug-instrumentation
• feat/oauth-admin-endpoints
• feat/passkey-ceremony-helpers
• feat/phone-2fa
• feat/phone-mfa
• feat/postgrest-abort-requests
• feat/private-stream
• feat/realtime-explicit-rest-call
• feat/semantic-release-automation
• feat/signed-out-reason
• feat/storage-download-query-params
• feat/storage-vector-buckets
• feat/stream-changes
• feat/support-new-realtime-features
• feat/workflow-improvements
• feat/workflow-phase4-developer-experience
• feat/workflow-phase5-additional-improvements
• fix-getclaims-token-decoding
• fix-private-only-stream-channel-10188984025532099214
• fix-to-string
• fix/align-platform-stats-casing
• fix/app-links-method-removal
• fix/assert-async-storage-constructor-1446
• fix/ci-wasm-test-timeout
• fix/dartio-usage
• fix/deprecate
• fix/empty-response
• fix/flutter-3x-windows-cache
• fix/functions-client-case-insensitive-header-check
• fix/functions-drain-error-event-stream
• fix/functions-exception
• fix/functions-parse-nonjson-error
• fix/gotrue-getclaims-asymmetric-jwt
• fix/gotrue-mfa-aal-missing-amr
• fix/gotrue-mfa-enroll-optional-issuer
• fix/gotrue-shared-header-mutation
• fix/gotrue-web
• fix/immutable-default-headers
• fix/new-api-key-format
• fix/oauth_server_formatexception
• fix/oauth_server_second_consent
• fix/passkeys-require-resident-key-upstream-fix
• fix/postgrest-escape-filter-array
• fix/postgrest-limit-range-override
• fix/postgrest-select-prefer-and-this-cleanup
• fix/prefer-header-empty-string-leak
• fix/proactive-token-refresh-on-resume
• fix/realtime
• fix/realtime-cancel-conn-subscription
• fix/realtime-channel-suppress-invalid-jwt-on-rejoin
• fix/realtime-connect-race-condition
• fix/realtime-in-filter-escape
• fix/realtime-ios-disconnect-detection
• fix/realtime-ios-dropped-connection-detection
• fix/realtime-lifecycle-queue
• fix/realtime-message-empty-map
• fix/realtime-null-int-conversion
• fix/realtime-postgres-changes-system-error
• fix/realtime-reconnect-after-disconnect
• fix/recover-session-duplicate-auth-error
• fix/recover-session-stale-refresh-token
• fix/regression-test-1372-auth-retryable-fetch-exception
• fix/release-tag-workflow
• fix/review-bugs
• fix/sdk-1278-drop-rxdart
• fix/sdk-475-drop-jwt-decode
• fix/sdk-compliance-workflow
• fix/session-expires-at-doc-clarification
• fix/setup-presence-flag
• fix/storage-client-wasm-compat
• fix/storage-encode-object-path
• fix/storage-exception-status-code
• fix/supabase-common-dcm-inferrable
• fix/supabase-flutter-preserve-url-params
• fix/toJson-print
• fix/uppercase-http-method
• fix/verify-otp-secure-email-change
• fix/web-hot-restart
• fix/web-oauth-code-cleanup
• grdsdev-patch-1
• grdsdev/align-dart-sdk-min-3-3-0
• grdsdev/auth-token-refresh
• grdsdev/automate-melos-release
• grdsdev/check-swift-pr-958
• grdsdev/docs-refreshtoken-completer
• grdsdev/fix-postgrest-http-method-case
• grdsdev/fix-release-workflow-failures
• grdsdev/flutter-auth-refresh-bug
• grdsdev/hartford-v1
• grdsdev/log-auth-state-errors
• grdsdev/postgrest-retry-flutter
• grdsdev/resilient-decoding
• grdsdev/retrigger-release-tagging
• grdsdev/sdk-816-realtime-class-docs
• grdsdev/share-yajson-isolate
• grdsdev/storage-setheader
• guilherme/ci
• guilherme/clibs-108-supabase-flutter-change-default-heartbeat-interval-to-25s
• guilherme/clibs-120-supabase-flutter-send-standard-client-headers-on-all
• guilherme/clibs-171-supabase-flutter-validate-uuid-on-admin-methods
• guilherme/clibs-282-supabase-flutter-implement-linkidentity-with-oidc
• guilherme/clibs-287-supabase-flutter-storageretrycontroller-causes-cant-finalize
• guilherme/clibs-294-supabase-flutter-remove-providers-check-for-the
• guilherme/clibs-379-supabase-flutter-implement-maxaffected-method
• guilherme/clibs-99-supabase-flutter-remove-jwt-check-and-send-x-client-info
• guilherme/feat-test
• guilherme/generate-app-token
• guilherme/remove-trailing-commas-rule
• guilherme/sdk-230-supabase-flutter-use-dedicated-storage-host-for-storage-lib
• guilherme/sdk-514-refreshsession-shouldnt-fail-because-currentsession-doesnt
• guilherme/sdk-524-duplicate-sdk-522-for-flutter
• guilherme/sdk-531-flutter-verify-optional-refs-handling-in-message
• guilherme/sdk-614-fix-verifyotp-parameter-validation-for-otptyperecovery
• guilherme/sdk-624-apply-reusable-ci-workflows-to-supabase-flutter
• guilherme/sdk-627-flutter-sdk-getclaims-crashes-on-first-use-with-asymmetric
• guilherme/sdk-640-fixrealtime-flutter-web-hot-restart-throws-typeerror-on
• guilherme/sdk-698-paritypostgrest-add-url-length-validation-and-timeout
• guilherme/sdk-784-featauth-add-setsession-support-for-both-access_token-and
• guilherme/sdk-789-fixstorage-_transformstorageurl-unconditionally-breaks
• guilherme/sdk-794-oauth-provider-custom-string
• iat/add-x-provider
• idempotent_initialization
• lukasklingsbo/sdk-1018-httpsend-per-event-url
• lukasklingsbo/sdk-1020-parityauth-verifyotp-for-email_change-returns-null
• lukasklingsbo/sdk-1023-parityauth-resend-with-pkce-flow-should-include
• lukasklingsbo/sdk-1029-paritypostgrest-return-structured-error-for-non-json-body-on
• lukasklingsbo/sdk-1032-parityauth-recognize-error-parameter-in-implicit-grant
• lukasklingsbo/sdk-1054-consolidate-ci-into-a-single-workflow-and-stop-re-running
• lukasklingsbo/sdk-1065-example-database-crud-with-postgrest
• lukasklingsbo/sdk-1077-enable-tiny-dcm-rules
• lukasklingsbo/sdk-1089-paritystorage-preserve-sortby-defaults-when-list-receives
• lukasklingsbo/sdk-1102-supabase_flutter-full-web-and-wasm-compatibility
• lukasklingsbo/sdk-1106-spike-smithytypespec-codegen-for-dartflutter-sdk-http-layer
• lukasklingsbo/sdk-1165-parityauth-add-shouldsoftdelete-option-to-admin-deleteuser
• lukasklingsbo/sdk-1166-paritystorage-add-download-content-disposition-option-to
• lukasklingsbo/sdk-1167-paritystorage-add-upsert-option-to-createsigneduploadurl
• lukasklingsbo/sdk-1168-paritypostgrest-add-format-option-to-explain
• lukasklingsbo/sdk-1169-parityrealtime-add-onheartbeat-listener
• lukasklingsbo/sdk-1173-parityauth-add-custom_claims_allowlist-to-custom-providers
• lukasklingsbo/sdk-1246-clean-up-package-metadata-readmes-license-and-examples
• lukasklingsbo/sdk-1258-parityfunctions-expose
• lukasklingsbo/sdk-1260-parityauth-add-channel-parameter-smswhatsapp-to-mfachallenge
• lukasklingsbo/sdk-1261-parityauth-expose-skipbrowserredirect-on-signinwithoauth
• lukasklingsbo/sdk-1262-parityfunctions-add-timeout-option-to-invoke
• lukasklingsbo/sdk-1272-parityclient-custom-session-url-detection-predicate-and
• lukasklingsbo/sdk-1279-chore-bump-all-dependencies
• lukasklingsbo/sdk-1283-modernize-dart-syntax-across-client-packages
• lukasklingsbo/sdk-1284-convert-private-stream-builder-holder-classes-to-records
• lukasklingsbo/sdk-1288-enable-strict-raw-types
• lukasklingsbo/sdk-1290-clean-up-package-tests-remove-abbreviations-and-code-smells
• lukasklingsbo/sdk-1308-analytics-bucket-crud
• lukasklingsbo/sdk-1309-iceberg-catalog
• lukasklingsbo/sdk-1310-featfunctions-request-cancellation-for-invoke-flutter-sdk
• lukasklingsbo/sdk-583-realtime-protocol-200
• lukasklingsbo/sdk-583-realtime-v3-renames
• lukasklingsbo/sdk-875-storage-cache-nonce
• lukasklingsbo/storage-download-stream
• lukasklingsbo/storage-list-v2
• main
• null-check-operator-on-realtime-conn
• refactor/bucket-oauth-dedupe
• refactor/extract-supabase-common
• refactor/gotrue-pkce-helper
• refactor/inline-retry
• refactor/realtime-broadcast-http
• refactor/refresh-flow
• refactor/storage-dedupe
• refactor/storage-drop-http-parser
• refactor/supabase-drop-rxdart
• refs/pull/1110/merge
• release-23586209249
• release-26828784805
• release-27010981394
• release-27216676269
• release-27629220657
• release-28404096617
• release-28444217699
• release-28535891613
• release-28651474608
• release-28853636227
• release-29417173135
• release-please/bootstrap/default
• remove-wasm-ci
• revert-commit
• shared_prefs_async
• storage
• test/improve-coverage-common-storage
• test/supabase-cli-integration-tests
• test/web
• test/yet-another-json-isolate-coverage
• unnecessary_current_user
• upgrade-github-actions-node24
• upgrade-github-actions-node24-general
• web-wasm-guardrails
• worktree-1496
• worktree-899
• worktree-SDK-1269
• worktree-SDK-1270
• worktree-SDK-1271
• worktree-SDK-1273
• worktree-SDK-1274
• worktree-SDK-1275
• worktree-SDK-1318
• worktree-SDK-701
• worktree-SDK-752
• worktree-SDK-753
• worktree-SDK-754
• worktree-SDK-878
• worktree-ci-release-tags
• worktree-ci-simplify
• worktree-ci-uppercase
• worktree-deferred_disconnect
• worktree-email-fix
• worktree-enums
• worktree-facebook-login-issue
• worktree-fix-coverage
• worktree-fix-tests
• worktree-fix-versioning
• worktree-flutter_lints
• worktree-passkeys-interface-types
• worktree-realtime-tests
• worktree-sdk-1331
• worktree-sdk-1332

Build # 27288413514

Build Type

Pull #1351

github

Committed by web-flow

Commit Message

Merge d45302c2a into de2adf998

Pull Request Pull Request #1351: fix(gotrue): prevent stale token refresh from overwriting concurrent session changes

Coverage Stats

41 of 46 new or added lines in 1 file covered. (89.13%)

1 existing line in 1 file now uncovered.

3616 of 4462 relevant lines covered (81.04%)

3.14 hits per line