What flutter/flutter shipped
Written by FoxPlug from public releases; not affiliated with Flutter. An automatic summary of the public release, pull request and commit data of github.com/flutter/flutter. Flutter did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 21, 2026
What shipped
- WebAssembly on web now enforces strict capability checks for Firefox and Safari, preventing dart2wasm builds from running on unsupported browser versions. Pull request #193180
- Android engine now refuses external configuration of entrypoint and cached engine arguments via Intents, closing a security gap. Pull request #190249
- TextPainter.getWordBoundary test is re-enabled on web and passes with both default and WebAssembly compilers. Pull request #193378
- Eight previously skipped painting and rendering tests now pass on web with both default and WebAssembly compilers. Pull request #193377
- Standard Flutter Android test apps updated to AGP 9.3.1 to support Android 17. Pull request #193263
- Linux FlView now properly handles frame drops when the view is destroyed before rendering completes. Pull request #193268
- Web accessibility improved by fixing VoiceOver item count in menus and assigning proper ARIA roles to named routes. Pull request #192965
- Flutter now supports DynamicLibrary.codeAsset with proper native-assets callback registration. Pull request #188947
- TextPainter.computeLineMetrics now caches paint offset adjusted line metrics to avoid rebuilding the list on every call. Pull request #191223
- Text selection handle dragging no longer auto-scrolls, preventing viewport flicker and jumps during user interaction. Pull request #185206
Why it matters
This week includes security hardening for Android Intent handling, improved web compatibility with WebAssembly support verification, and fixes for text rendering performance and selection behavior. The test improvements and accessibility fixes also expand platform coverage and usability across web browsers.
Changelog entry
- WebAssembly: Enforce strict capability checks and browser version guards on Firefox and Safari Pull request #193180
- Android: Security fix - refuse external engine entrypoint and cached arguments via Intents (breaking change) Pull request #190249
- Web: TextPainter.getWordBoundary test now passes and is re-enabled Pull request #193378
- Web: Eight painting and rendering tests re-enabled and passing with default and WebAssembly compilers Pull request #193377
- Android: Bump test apps to AGP 9.3.1, KGP 2.4.20, Gradle 9.5.0 for Android 17 support Pull request #193263
- Linux: Fix FlView handling when destroyed before rendering completes Pull request #193268
- Web: Fix VoiceOver item count and assign proper ARIA region roles to named routes Pull request #192965
- Native assets: Add DynamicLibrary.codeAsset support with proper callback registration Pull request #188947
- Text: Cache paint offset adjusted line metrics in TextPainter to avoid repeated list rebuilds Pull request #191223
- Text selection: Disable auto-scrolling during selection handle drag to prevent viewport flicker Pull request #185206
Flutter shipped security fixes for Android, stricter WebAssembly capability checks on web, test improvements across platforms, and fixes for text selection and rendering performance.
This week's Flutter updates include important security hardening on Android by refusing external Intent-based engine configuration, stricter WebAssembly capability verification on Firefox and Safari, eight newly passing web tests with both standard and WebAssembly compilers, Android 17 support in test templates, improved web accessibility for menus and routes, and performance optimizations for text metrics and selection handling.