essentialRules top-level constant
Essential tier rules - Critical rules that prevent crashes, data loss, and security holes. A single violation causes real harm: app crashes, data exposed, resources never released.
Implementation
const Set<String> essentialRules = <String>{
// receive_sharing_intent (receive_sharing_intent_rules.dart) - cold-start data loss
'rsi_missing_initial_media',
// awesome_notifications (awesome_notifications_rules.dart) - runtime-fatal handler defects
'awesome_notifications_non_static_listener',
'awesome_notifications_handler_wrong_parameter_type',
// Memory Leaks - Controllers (dispose)
'require_field_dispose',
'require_animation_disposal',
'avoid_undisposed_instances',
'require_value_notifier_dispose',
'require_focus_node_dispose',
'require_page_controller_dispose',
'require_media_player_dispose',
// Memory Leaks - Timers & Subscriptions (cancel)
'avoid_unassigned_stream_subscriptions',
'require_stream_controller_dispose',
'always_remove_listener',
// Flutter Lifecycle - causes crashes
'avoid_setstate_in_build', // Infinite loop/crash
'avoid_inherited_widget_in_initstate',
'avoid_recursive_widget_calls',
'avoid_global_key_in_build',
'pass_existing_future_to_future_builder',
'pass_existing_stream_to_stream_builder',
'avoid_duplicate_widget_keys',
'avoid_mounted_in_setstate',
'avoid_storing_context',
'avoid_context_across_async',
'avoid_context_after_await_in_static', // ERROR - context after await in static
'require_init_state_idempotent',
// Security
'avoid_hardcoded_credentials',
'avoid_logging_sensitive_data',
// 'avoid_sensitive_data_in_logs' removed v4.2.3 - alias of avoid_sensitive_in_logs
'avoid_eval_like_patterns',
'avoid_weak_cryptographic_algorithms',
'avoid_token_in_url',
'avoid_clipboard_sensitive',
'avoid_storing_passwords',
'require_input_validation',
'avoid_dynamic_sql',
'avoid_hardcoded_encryption_keys',
'prefer_secure_random_for_crypto',
'avoid_deprecated_crypto_algorithms',
'require_unique_iv_per_encryption',
'avoid_dynamic_code_loading', // OWASP M2 - supply chain
'avoid_unverified_native_library', // OWASP M2 - supply chain
// Null Safety
'avoid_null_assertion',
'avoid_unsafe_collection_methods',
'avoid_unsafe_where_methods',
'avoid_unsafe_reduce',
'avoid_late_final_reassignment',
// Parameter Safety - Hidden side effects
'avoid_parameter_mutation', // Mutating parameters modifies caller's data
// State Management - Critical (Batch 10)
'avoid_bloc_event_mutation', // Immutability is critical
'require_initial_state', // Runtime crash without it
'avoid_instantiating_in_bloc_value_provider', // Memory leak
'avoid_existing_instances_in_bloc_provider', // Unexpected closure
'avoid_instantiating_in_value_provider', // Memory leak (Provider package)
'require_provider_dispose', // Resource cleanup
'avoid_getx_context_outside_widget', // Unsafe context access outside widgets
'avoid_hooks_outside_build', // Runtime error
'avoid_conditional_hooks', // Runtime error
// Forms - Critical (Batch 12)
'require_form_key', // Forms won't work without it
'avoid_clearing_form_on_error', // Data loss
// Async
'avoid_throw_in_finally',
'avoid_uncaught_future_errors', // Alias: require_future_error_handling
// Collections
'avoid_duplicate_map_keys',
'avoid_isar_enum_field',
'require_exhaustive_sealed_switch',
'require_pagination_for_large_lists', // OOM when bulk list as itemCount
// Equatable (Essential - missing fields cause equality bugs)
'list_all_equatable_fields',
'avoid_mutable_field_in_equatable', // Mutable fields break equality
// Architecture
'avoid_circular_dependencies',
// GetIt/DI (Essential - wrong usage)
'avoid_functions_in_register_singleton',
// Resource Management
'require_native_resource_cleanup',
'require_file_close_in_finally',
'require_websocket_close',
// Error Handling
'avoid_swallowing_exceptions',
'avoid_losing_stack_trace',
'require_error_handling_graceful',
'avoid_print_error', // Print for error logging loses errors in production
// Collection/Loop Safety (Phase 2)
'avoid_unreachable_for_loop',
// Remaining ROADMAP_NEXT - resource cleanup
'dispose_provided_instances',
// Widget Structure
'avoid_nested_scaffolds',
'avoid_multiple_material_apps',
// Build Method Anti-patterns (Critical)
'avoid_dialog_in_build',
'require_tab_controller_length_sync',
// Scroll/List (Essential - prevent runtime errors and performance issues)
'require_key_for_reorderable', // ERROR - reordering fails without keys
'avoid_shrink_wrap_expensive', // WARNING - disables virtualization
// Type Safety (Critical - throws runtime exceptions)
'prefer_try_parse_for_dynamic_data',
'avoid_double_for_money',
// Animation (Essential - prevent crashes)
'require_vsync_mixin',
'require_animation_controller_dispose',
'require_animation_ticker_disposal', // Ticker must be stopped to prevent memory leaks
// Resource Management (Essential - prevent hardware lock)
'require_camera_dispose',
// Disposal Pattern Detection (Essential - memory leaks)
'require_bloc_manual_dispose', // Bloc/Cubit with disposable resources
'require_getx_worker_dispose', // GetX Workers must be disposed in onClose
'require_getx_permanent_cleanup', // Get.put(permanent: true) needs cleanup
'require_image_stream_dispose', // ImageStream listeners must be removed
'require_sse_subscription_cancel', // SSE connections must be closed
// Accessibility (Essential - critical errors)
'avoid_hidden_interactive',
'require_error_identification',
'require_minimum_contrast',
// Navigation (Essential - prevent crashes)
'require_unknown_route_handler',
'avoid_context_after_navigation',
'require_route_guards',
'avoid_circular_redirects',
// Riverpod (Essential - prevent crashes)
'avoid_ref_in_dispose',
'require_provider_scope',
'avoid_circular_provider_deps',
'require_error_handling_in_async',
'avoid_ref_read_inside_build',
'avoid_ref_watch_outside_build',
'avoid_ref_inside_state_dispose',
'use_ref_read_synchronously',
'use_ref_and_state_synchronously',
'avoid_assigning_notifiers',
// Bloc (Essential - prevent crashes)
'check_is_not_closed_after_async_gap',
'avoid_duplicate_bloc_event_handlers',
// Build Performance (Essential - prevent memory leaks)
'avoid_scroll_listener_in_build',
// Security (Essential - prevent data leaks)
'avoid_auth_in_query_params',
'require_deep_link_validation',
// Firebase (Essential - prevent crashes)
'require_firebase_init_before_use',
'require_firebase_reauthentication',
'require_firebase_token_refresh',
'incorrect_firebase_event_name',
'incorrect_firebase_parameter_name',
// Notification (Essential - required for Android 8+)
'require_notification_channel_android',
// Testing (Essential - prevent flaky tests)
'avoid_datetime_now_in_tests',
'missing_test_assertion',
'avoid_async_callback_in_fake_async',
'avoid_test_sleep', // WARNING - blocks test runner, use pump() instead
// QR/Camera (Essential - app store compliance)
'require_qr_permission_check',
'require_qr_content_validation', // Security - validate scanned content
// PDF (Essential - memory safety)
'avoid_loading_full_pdf_in_memory', // OOM prevention
// Lifecycle (Essential - battery/stability)
'require_lifecycle_observer',
// Disposal (roadmap_up_next - memory leak)
'require_stream_subscription_cancel',
// Async (roadmap_up_next - runtime crash)
'avoid_dialog_context_after_async',
// ROADMAP ⭐ Rules - Essential
'avoid_shared_prefs_in_isolate', // ERROR - SharedPreferences doesn't work in isolates
'avoid_future_in_build', // ERROR - causes rebuilds and state issues
'require_mounted_check_after_await', // ERROR - setState after dispose
'provide_correct_intl_args', // ERROR - runtime crash from mismatched intl args
'dispose_class_fields', // WARNING - memory leaks from undisposed fields
'avoid_async_in_build', // ERROR - async build causes rendering issues
// Package-specific rules (Essential - security/crash prevention)
'require_apple_signin_nonce', // Security - replay attack prevention
'avoid_supabase_anon_key_in_code', // Security - credential exposure
'require_supabase_realtime_unsubscribe', // Memory leak - channel disposal
'require_webview_ssl_error_handling', // Security - certificate validation
'require_workmanager_result_return', // Crash prevention - task status
'require_speech_stop_on_dispose', // Resource leak - microphone
'avoid_app_links_sensitive_params', // Security - token exposure
'avoid_openai_key_in_code', // Security - API key exposure
// Part 5 - Security Rules (Essential)
'avoid_shared_prefs_sensitive_data',
'require_secure_storage_for_auth',
'require_sqflite_whereargs',
'require_hive_initialization',
'require_hive_type_adapter',
'require_hive_encryption_key_secure',
'avoid_drift_enum_index_reorder', // ERROR - data corruption from enum .index storage
'avoid_drift_insert_missing_conflict_target', // ERROR - runtime crash (SqliteException 2067) when UNIQUE index is not targeted
'require_type_adapter_registration', // ERROR - adapter not registered before openBox
'avoid_hive_field_index_reuse', // ERROR - data corruption from duplicate indices
// Part 5 - HTTP/Dio Rules (Essential)
'require_dio_timeout',
'require_dio_error_handling',
// Part 5 - Stream/Future Rules (Essential)
'avoid_stream_in_build',
'require_stream_controller_close',
// Part 5 - Riverpod Rules (Essential)
'require_riverpod_error_handling',
'avoid_riverpod_state_mutation',
// Part 5 - Navigation Rules (Essential)
'avoid_go_router_inline_creation',
// Part 5 - Geolocator Rules (Essential)
'require_geolocator_permission_check',
// Part 5 - Image Rules (Essential)
'require_cached_image_dimensions',
// Part 6 - State Management Rules (Essential)
'avoid_yield_in_on_event', // Critical - deprecated/broken in Bloc 8.0+
'emit_new_bloc_state_instances', // Critical - state mutation breaks equality
'avoid_listen_in_async', // High - subscription leaks in async callbacks
// Part 6 - Security Rules (Essential)
'require_url_validation',
'avoid_redirect_injection',
'avoid_external_storage_sensitive',
// Part 6 - Form Rules (Essential)
'avoid_keyboard_overlap',
'require_search_debounce', // Prevents request spam
// Image Picker Rules (Essential - OOM prevention)
'prefer_image_picker_max_dimensions', // WARNING - OOM on high-res cameras
'avoid_unawaited_future', // WARNING - lost errors
'avoid_catch_all', // WARNING - bare catch without on clause
'avoid_catch_exception_alone', // WARNING - misses Error types
'require_form_key_in_stateful_widget', // WARNING - form state loss
'prefer_timeout_on_requests', // WARNING - hang prevention
'require_connectivity_timeout', // WARNING - hang prevention
'avoid_bloc_context_dependency', // WARNING - testability
'avoid_provider_value_rebuild', // WARNING - memory leak
'avoid_notification_same_id', // WARNING - overwrites
'require_intl_plural_rules', // WARNING - i18n correctness
'require_mock_http_client', // WARNING - test reliability
'require_image_cache_dimensions', // WARNING - OOM prevention
'avoid_expanded_outside_flex', // ERROR - runtime crash
'prefer_expanded_at_call_site', // ERROR - Expanded in build() crashes if misused
'avoid_table_cell_outside_table', // ERROR - ParentData crash
'avoid_positioned_outside_stack', // ERROR - ParentData crash
'avoid_spacer_in_wrap', // ERROR - flex paradox crash
'avoid_animated_size_in_wrap', // ERROR - AnimatedSize re-dirty crash in Wrap/Flow
'avoid_scrollable_in_intrinsic', // ERROR - geometry loop crash
'require_baseline_text_baseline', // ERROR - assertion failure
'avoid_unconstrained_dialog_column', // WARNING - probable dialog overflow
'avoid_unbounded_listview_in_column', // ERROR - unbounded constraints crash
'avoid_textfield_in_row', // ERROR - unbounded width crash
'avoid_fixed_size_in_scaffold_body', // WARNING - probable keyboard overflow
'require_test_widget_pump', // ERROR - flaky tests
'require_hive_adapter_registration_order', // ERROR - runtime crash
'require_hive_nested_object_adapter', // ERROR - runtime crash
'avoid_api_key_in_code', // ERROR - security critical
'avoid_storing_sensitive_unencrypted', // ERROR - security critical
'avoid_ignoring_ssl_errors', // ERROR - MITM attack prevention (OWASP M5, A05)
'require_https_only', // WARNING - unencrypted traffic (OWASP M5, A05)
'avoid_unsafe_deserialization', // WARNING - data integrity (OWASP A08)
'avoid_user_controlled_urls', // WARNING - SSRF prevention (OWASP A10)
'require_catch_logging', // WARNING - security event logging (OWASP A09)
'require_intl_args_match', // ERROR - runtime crash
'require_cache_key_determinism', // ERROR - memory bloat
'require_https_for_ios', // WARNING - ATS blocking
'require_ios_info_plist_entries', // ERROR - Info.plist keys required for permission APIs
'require_ios_permission_description', // WARNING - App Store rejection
'require_ios_privacy_manifest', // WARNING - iOS 17+ requirement
'require_apple_sign_in', // ERROR - App Store rejection
'require_ios_app_tracking_transparency', // ERROR - App Store rejection without ATT
'require_ios_face_id_usage_description', // WARNING - crash without Info.plist entry
'avoid_ios_in_app_browser_for_auth', // ERROR - OAuth blocked by Google/Apple
'require_ios_local_notification_permission', // WARNING - silent notification failures
'require_ios_healthkit_authorization', // WARNING - silent data access failures
'avoid_macos_catalyst_unsupported_apis', // WARNING - crashes on Mac Catalyst
'require_ios_receipt_validation', // WARNING - IAP fraud prevention
'avoid_long_running_isolates', // WARNING - iOS kills isolates after 30 seconds
'require_purchase_verification', // ERROR - IAP receipt fraud prevention
'require_purchase_restoration', // ERROR - App Store requires restore purchases
'require_ios_data_protection', // WARNING - file encryption for sensitive data
// =========================================================================
// Critical/High rules (no orphans - performance/UX rules moved to Recommended)
// =========================================================================
// Security (Critical)
'avoid_deep_link_sensitive_params', // ERROR - token exposure in deep links
'avoid_path_traversal', // ERROR - directory traversal attack
'require_data_encryption', // ERROR - sensitive data must be encrypted
'require_secure_password_field', // ERROR - password field security
// Platform/Permissions (Critical)
'avoid_platform_channel_on_web', // ERROR - crashes on web
// Widget Lifecycle (Critical/High)
'avoid_ref_in_build_body', // ERROR - ref.watch in wrong place
'avoid_flashing_content', // ERROR - accessibility seizure risk
// Animation (High)
'avoid_overlapping_animations', // WARNING - animation conflicts
// Firebase/Backend (High)
'prefer_firebase_remote_config_defaults', // WARNING - config defaults
'require_background_message_handler', // WARNING - FCM background
'require_fcm_token_refresh_handler', // WARNING - token refresh
// WebView (High)
'require_websocket_message_validation', // WARNING - message validation
// Data/Storage (High)
'prefer_utc_for_storage', // WARNING - timezone consistency
'require_database_migration', // WARNING - migration safety
// UI/UX (High)
'prefer_html_escape', // WARNING - XSS prevention
'require_error_widget', // WARNING - error boundary
'require_feature_flag_default', // WARNING - feature flag safety
'require_map_idle_callback', // WARNING - map performance
'require_media_loading_state', // WARNING - loading indicators
// Network (High)
'require_cors_handling', // WARNING - CORS on web
// NEW v4.1.6 Rules - Essential
'avoid_print_in_release', // ERROR - print() executes in release builds
'avoid_sensitive_in_logs', // ERROR - no sensitive data in logs
'prefer_platform_io_conditional', // ERROR - Platform checks crash on web
'avoid_web_only_dependencies', // ERROR - dart:html crashes on mobile
'require_date_format_specification', // WARNING - DateTime.parse may fail
'avoid_optional_field_crash', // ERROR - null JSON field access crashes
'avoid_hardcoded_config', // WARNING - hardcoded URLs and keys
'avoid_mixed_environments', // ERROR - prod/dev config mismatch
'require_late_initialization_in_init_state', // WARNING - late init in build()
// NEW v4.1.7 Rules - Essential
'require_websocket_reconnection', // WARNING - WebSocket needs reconnection
'avoid_sensitive_data_in_clipboard', // WARNING - clipboard accessible to other apps
'avoid_unbounded_cache_growth', // WARNING - caches without limits cause OOM
// Critical disposal/state rules (auto-assigned by severity)
'prefer_copy_with_for_state',
'require_bloc_close',
'require_error_state',
'require_mounted_check',
'check_mounted_after_async', // setState after dispose crash (README Essential example)
'require_scroll_controller_dispose',
'require_tab_controller_dispose',
'require_text_editing_controller_dispose',
// Moved from Recommended (cause crashes, not just poor UX)
'require_getit_registration_order', // startup crash
'require_default_config', // startup crash
'avoid_builder_index_out_of_bounds', // runtime crash
'require_ios_keychain_for_credentials', // security critical - credential exposure
// Note: require_purchase_verification already in Essential at line 421
// =========================================================================
// v4.2.0 ROADMAP ⭐ Rules - Essential
// =========================================================================
'require_android_manifest_entries', // ERROR - permission-gated APIs need manifest entries
'avoid_audio_in_background_without_config', // ERROR - background audio needs platform config
'avoid_geolocator_background_without_config', // ERROR - background location needs platform config
'require_notification_icon_kept', // ERROR - ProGuard must keep notification icons
'require_env_file_gitignore', // ERROR - .env must be gitignored
'require_android_permission_request', // ERROR - permissions must be requested at runtime
'require_android_exact_alarm_permission', // WARNING - Android 14 downgrades exact alarms without the permission
'prefer_pending_intent_flags', // ERROR - PendingIntent needs FLAG_IMMUTABLE/MUTABLE
'avoid_android_cleartext_traffic', // WARNING - cleartext traffic blocked by default
'avoid_purchase_in_sandbox_production', // ERROR - sandbox/production environment mix
'require_subscription_status_check', // WARNING - must check subscription status
'require_location_permission_rationale', // WARNING - location permission needs rationale
'require_camera_permission_check', // ERROR - camera needs permission check
'require_firestore_index', // ERROR - Firestore queries need composite indexes
'require_firestore_security_rules', // ERROR - firestore.rules must exist for Cloud Firestore projects
'require_firebase_composite_index', // ERROR - RTDB queries need .indexOn rules
'avoid_notification_silent_failure', // WARNING - notification failures should be handled
'require_file_path_sanitization', // WARNING - file paths need sanitization
'require_app_startup_error_handling', // WARNING - app startup needs error handling
'avoid_assert_in_production', // WARNING - asserts don't run in production
'prefer_lazy_loading_images', // WARNING - large images should be lazy loaded
'avoid_sqflite_type_mismatch', // ERROR - SQLite type mismatches cause runtime errors
'avoid_sudo_shell_commands', // ERROR - elevated privileges are a security risk
// ROADMAP ⭐ Rules - Essential (new batch)
'avoid_context_dependency_in_callback', // WARNING - stale context in async callbacks
'avoid_hive_synchronous_in_ui', // WARNING - sync Hive I/O blocks UI thread
// ROADMAP 🚨 Rules (Essential - ERROR severity)
'avoid_drift_raw_sql_interpolation', // ERROR - SQL injection (OWASP A03)
'avoid_getx_build_context_bypass', // ERROR - bypasses BuildContext
'avoid_permission_handler_null_safety', // ERROR - deprecated API
'avoid_retaining_disposed_widgets', // ERROR - memory leak from widget refs
'require_secure_key_generation', // ERROR - hardcoded encryption keys
'require_hive_web_subdirectory', // ERROR - web storage conflicts
// v4.14.0 - GitHub issue rules (Essential)
'avoid_blocking_main_thread', // WARNING - sync I/O blocks main thread
// v4.15.0 - ROADMAP ⭐ Rules (Essential)
'avoid_cached_image_unbounded_list', // WARNING - unbounded image cache in lists
// v4.16.0 - ROADMAP ⭐ Rules (Essential)
'avoid_color_only_meaning', // WARNING - WCAG 1.4.1 color-only indicators
'avoid_excessive_rebuilds_animation', // WARNING - too many widgets in builder
'avoid_misused_hooks', // WARNING - hooks in callbacks/closures
// v5.1.0 - Migration rules (Essential)
'avoid_asset_manifest_json', // ERROR - removed in Flutter 3.38.0, runtime crash
// v5.1.0 - Batch 2 (Essential)
'require_auto_route_guard_resume', // WARNING - missing resolver.next()
'require_auto_route_full_hierarchy', // WARNING - push() bypasses hierarchy
// v5.1.0 - Batch 3 (Essential)
'avoid_connectivity_equals_internet', // WARNING - ConnectivityResult != internet
// Additional rules (plan_additional_rules_11_through_20)
// Removed: `saropa_depend_on_referenced_packages` (and its earlier alias
// `depend_on_referenced_packages`). The Dart SDK lint of the same name
// already ships via `package:lints/core.yaml`, so delegating to it avoids
// both double-reporting AND the parallel-implementation false positives
// that were firing on every `package:<ownPkg>/...` import in real
// projects. Users still get the check through `flutter_lints` / `lints`.
'uri_does_not_exist', // ERROR - import/export/part URI missing
// Additional rules (plan_additional_rules_21_through_30)
'conflicting_constructor_and_static_member',
'duplicate_constructor_declarations',
'duplicate_field_name',
'field_initializer_redirecting_constructor',
'illegal_concrete_enum_member',
'invalid_extension_argument_count',
'invalid_field_name',
'invalid_literal_annotation',
'invalid_non_virtual_annotation',
'invalid_super_formal_parameter_location',
// Additional rules (plan_additional_rules_31_through_40)
'abstract_field_initializer',
'abi_specific_integer_invalid',
'annotate_inherited_member_redeclaration',
'deprecated_new_in_comment_reference',
'document_analyzer_ignore_rationale',
'non_constant_map_element',
'return_in_generator',
'subtype_of_disallowed_type',
'undefined_enum_constructor',
'yield_in_non_generator',
};