flutter_secure_storage pinned to 10.0.0 — secure storage unusable on unsigned/dev macOS (darwin 0.2.0 bugs fixed upstream)

[EH-MLS]

Summary

flet-secure-storage pins flutter_secure_storage: 10.0.0 in its bundled Flutter pubspec.yaml. That resolves flutter_secure_storage_darwin 0.2.0, which has two macOS bugs — both already fixed upstream — that make secure storage unusable on unsigned / development macOS apps.

The problem on macOS

On macOS, flutter_secure_storage defaults to the data-protection keychain, which requires the keychain-access-groups entitlement (an embedded provisioning profile). Unsigned or unprovisioned apps — including flet run and an unsigned flet build macos — fail every write with errSecMissingEntitlement (-34018).

The documented escape hatch is MacOsOptions(usesDataProtectionKeychain: false), which should route to the login keychain (no entitlement required). In darwin 0.2.0 that option is inert:

1. Key-name mismatch — the Dart side sends usesDataProtectionKeychain, but the Swift side read a differently-cased key and defaulted it to true, so the data-protection keychain was always used regardless of the option.
2. A follow-up issue where kSecUseDataProtectionKeychain was added to the keychain query even when false, still tripping the entitlement.

Net effect with the current pin: there is no way for an unsigned/dev macOS Flet app to persist values — the data-protection path -34018s, and the login-keychain fallback is unreachable.

Already fixed upstream

• Key-name fix — flutter_secure_storage_darwin 0.3.0 (fix: align macOS options keys in darwin plugin juliansteenbakker/flutter_secure_storage#1047, merged 2026-02-10)
• Query fix — 0.3.2 (fix: only add kSecUseDataProtectionKeychain if param is set to true juliansteenbakker/flutter_secure_storage#1136, merged 2026-05-22)
• Current darwin is 0.4.0; current umbrella flutter_secure_storage is 10.3.1 stable (11.0.0-beta.1 prerelease requires flutter_secure_storage_darwin: ^0.4.0).

Verification

I confirmed the fix end-to-end. A flet build macos app, ad-hoc signed (no provisioning profile), with:

[tool.flet.flutter.pubspec.dependency_overrides]
flutter_secure_storage = "10.3.1"
flutter_secure_storage_darwin = "0.4.0"

and MacOsOptions(uses_data_protection_keychain=False) successfully wrote and read back a value from the macOS login keychain — no -34018. With the default pin (darwin 0.2.0) the same app fails. Inspecting the built framework, only the corrected usesDataProtectionKeychain key is compiled in once the override is applied.

Note: flet run uses the prebuilt flet-desktop binary, which bakes the plugin in at release time, so it cannot benefit from dependency_overrides and stays broken until a new flet-desktop binary ships against the newer plugin. A pin bump fixes both flet build and flet run.

Also worth flagging: on macOS, get_availability() returns True even while every write fails with -34018, so it can't be used as a pre-flight check — a write round-trip is the only reliable signal.

Request

Bump flet-secure-storage's flutter_secure_storage pin from 10.0.0 to a current release (latest stable 10.3.1) that resolves flutter_secure_storage_darwin ≥ 0.3.2. This restores OS-backed secure storage for unsigned/dev macOS apps (via the login keychain) without requiring provisioning, and — once a new prebuilt binary ships — fixes flet run too.

Happy to open a PR for the pin bump if that would help.

Environment

• flet / flet-secure-storage 0.85.2
• macOS (Apple Silicon)
• Pinned flutter_secure_storage: 10.0.0 → resolves flutter_secure_storage_darwin: 0.2.0

[FeodorFitsner]

Thanks for letting know!

[FeodorFitsner]

You can override flutter_secure_storage by adding this to your pyproject.toml:

[tool.flet.flutter.pubspec.dependency_overrides]
flutter_secure_storage = '10.3.1'

[EH-MLS]

Thanks for the dependency_overrides tip, @FeodorFitsner — it works great for flet build.

One thing to flag for anyone else hitting this: the override only fixes flet build (which compiles the Flutter client from source). It doesn't help flet run, which uses the prebuilt flet-desktop binary baked against the pinned flutter_secure_storage: 10.0.0. So both dev (flet run) and packaged (flet build) apps need the default pin bumped plus a fresh prebuilt release before secure storage works out of the box on unsigned/dev macOS.

To save you some work, I've opened a small PR that bumps the default pin to 10.3.1: #6591. I kept it minimal (just the source-of-truth pin), and I've enabled "Allow edits by maintainers," so please feel free to take it over, regenerate the lockfiles in CI, adjust the version, or rework it however fits best.

Happy to iterate on it — thanks again for maintaining Flet!