chore(release): pull release/5.1.0 into main (#282)

* chore: apply security best practices from step security (#274)

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Co-authored-by: stepsecurity-app[bot] <188008098+stepsecurity-app[bot]@users.noreply.github.com>

* chore: apply security best practices from step security (#280)

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Co-authored-by: stepsecurity-app[bot] <188008098+stepsecurity-app[bot]@users.noreply.github.com>

* chore(example): add functionality to spawn multiple plugin instances (#279)

* chore(example): add functionality to spawn multiple plugin instances

This will help in reproducing the issue and validating any new changes in future; which otherwise would require a manual setup.

🔒 Scanned for secrets using gitleaks 8.28.0

* chore(example): add an explicit config param to enable lifecycle events

This will help us while disabling the auto lifecycle tracking feature.

🔒 Scanned for secrets using gitleaks 8.28.0

* chore(example): move the functionality to spawn multiple plugin instance in a new screen

🔒 Scanned for secrets using gitleaks 8.28.0

* feat(braze): bump braze android and ios sdk minimum version to the latest (#281)

* feat(braze): bump rudder braze android minm version to 2.1.0

🔒 Scanned for secrets using gitleaks 8.28.0

* feat(braze): bump rudder braze ios minm version to 4.2

🔒 Scanned for secrets using gitleaks 8.28.0

* chore: update podfile.lock

🔒 Scanned for secrets using gitleaks 8.28.0

* chore(release): release new package versions

 - rudder_integration_braze_flutter@2.5.0
 - rudder_sdk_flutter_monorepo@5.1.0

---------

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Co-authored-by: Abhishek Pandey <64667840+1abhishekpandey@users.noreply.github.com>
Co-authored-by: stepsecurity-app[bot] <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Co-authored-by: GitHub actions <noreply@github.com>

Author: 3 people

.github/workflows/build-and-quality-checks.yml

@@ -5,21 +5,29 @@ on:
     branches: ['develop', 'main']
     types: ['opened', 'reopened', 'synchronize']
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build & Code Quality Checks
     runs-on: macos-latest
     if: startsWith(github.event.pull_request.head.ref, 'release/') != true
 
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Setup Dart
         uses: dart-lang/setup-dart@e51d8e571e22473a2ddebf0ef8a2123f0ab2c02c #v1.3
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           distribution: 'zulu'
           java-version: '11'

.github/workflows/check_pr_title.yml

@@ -11,8 +11,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - name: Checkout source branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Check PR title
-        uses: rudderlabs/github-action-check-pr-title@v1.0.11
+        uses: rudderlabs/github-action-check-pr-title@0a83071336f7d6417249629f67a64530fcecda2e # v1.0.11

.github/workflows/create-hotfix-branch.yml

@@ -7,14 +7,22 @@ on:
         description: Hotfix branch name
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   create-branch:
     name: Create new branch
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main'
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
 

.github/workflows/deploy-pubdev.yml

@@ -18,8 +18,13 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/heads/main') || github.event.workflow_run.conclusion == 'success'
 
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
           # For workflow_run triggers, explicitly use main branch
@@ -30,7 +35,7 @@ jobs:
         uses: dart-lang/setup-dart@e51d8e571e22473a2ddebf0ef8a2123f0ab2c02c #v1.3
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           distribution: 'zulu'
           java-version: '11'

.github/workflows/draft-new-release.yml

@@ -3,22 +3,32 @@ name: Draft new release
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   draft-new-release:
+    permissions:
+      contents: write  # for Git to git push
     name: Draft a new release
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/heads/develop') || startsWith(github.ref, 'refs/heads/hotfix/')
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - name: Checkout source branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
 
       - name: Setup Dart
         uses: dart-lang/setup-dart@e51d8e571e22473a2ddebf0ef8a2123f0ab2c02c #v1.3
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           distribution: 'zulu'
           java-version: '11'

.github/workflows/housekeeping.yaml

@@ -14,7 +14,12 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/stale@v9
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
         with:
           repo-token: ${{ github.token }}
           operations-per-run: 200
@@ -27,8 +32,13 @@ jobs:
     name: Cleanup old branches
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
 

.github/workflows/publish-new-release.yml

@@ -13,6 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     if: (startsWith(github.event.pull_request.head.ref, 'release/') || startsWith(github.event.pull_request.head.ref, 'hotfix-release/')) && github.event.pull_request.merged == true # only merged pull requests must trigger this job
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - name: Extract version from branch name (for release branches)
         id: extract-version
         run: |
@@ -23,12 +28,12 @@ jobs:
           echo "release_version=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 16
 
@@ -63,15 +68,15 @@ jobs:
           pr_reviewer: '@rudderlabs/sdk-flutter'
 
       - name: Delete hotfix release branch
-        uses: koj-co/delete-merged-action@master
+        uses: koj-co/delete-merged-action@63a03c35810a8a7d4840d18793c0f68ff8b59450 # master
         if: startsWith(github.event.pull_request.head.ref, 'hotfix-release/')
         with:
           branches: 'hotfix-release/*'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Delete release branch
-        uses: koj-co/delete-merged-action@master
+        uses: koj-co/delete-merged-action@63a03c35810a8a7d4840d18793c0f68ff8b59450 # master
         if: startsWith(github.event.pull_request.head.ref, 'release/')
         with:
           branches: 'release/*'

.github/workflows/test.yml

@@ -15,16 +15,21 @@ jobs:
     if: startsWith(github.event.pull_request.head.ref, 'release/') != true
 
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
 
       - name: Setup Dart
         uses: dart-lang/setup-dart@e51d8e571e22473a2ddebf0ef8a2123f0ab2c02c #v1.3
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           distribution: 'zulu'
           java-version: '11'

CHANGELOG.md

@@ -3,6 +3,36 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## 2025-12-08
+
+### Changes
+
+---
+
+Packages with breaking changes:
+
+ - There are no breaking changes in this release.
+
+Packages with other changes:
+
+ - [`rudder_integration_braze_flutter` - `v2.5.0`](#rudder_integration_braze_flutter---v250)
+ - [`rudder_sdk_flutter_monorepo` - `v5.1.0`](#rudder_sdk_flutter_monorepo---v510)
+
+---
+
+#### `rudder_integration_braze_flutter` - `v2.5.0`
+
+ - **FEAT**(braze): bump braze android and ios sdk minimum version to the latest ([#281](https://github.com/rudderlabs/rudder-sdk-flutter/issues/281)). ([ce4868f4](https://github.com/rudderlabs/rudder-sdk-flutter/commit/ce4868f4ab0107993c2c79a36605cb00dde2640b))
+
+#### `rudder_sdk_flutter_monorepo` - `v5.1.0`
+
+ - **FEAT**(braze): bump braze android and ios sdk minimum version to the latest ([#281](https://github.com/rudderlabs/rudder-sdk-flutter/issues/281)). ([ce4868f4](https://github.com/rudderlabs/rudder-sdk-flutter/commit/ce4868f4ab0107993c2c79a36605cb00dde2640b))
+
+## 5.1.0
+
+ - **FEAT**(braze): bump braze android and ios sdk minimum version to the latest ([#281](https://github.com/rudderlabs/rudder-sdk-flutter/issues/281)). ([ce4868f4](https://github.com/rudderlabs/rudder-sdk-flutter/commit/ce4868f4ab0107993c2c79a36605cb00dde2640b))
+
+
 ## 2025-10-23
 
 ### Changes

example/android/app/src/main/java/com/rudderstack/rudder_sdk_flutter_example/MainActivity.java

@@ -1,5 +1,59 @@
 package com.rudderstack.rudder_sdk_flutter_example;
 
+import android.os.Bundle;
+import androidx.annotation.NonNull;
 import io.flutter.embedding.android.FlutterActivity;
+import io.flutter.embedding.engine.FlutterEngine;
+import io.flutter.embedding.engine.FlutterEngineGroup;
+import io.flutter.embedding.engine.dart.DartExecutor;
+import io.flutter.plugin.common.MethodChannel;
+import java.util.ArrayList;
+import java.util.List;
 
-public class MainActivity extends FlutterActivity {}
+public class MainActivity extends FlutterActivity {
+    private static final String CHANNEL = "test_engine_channel";
+    private FlutterEngineGroup engineGroup;
+    private List<FlutterEngine> backgroundEngines = new ArrayList<>();
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        // Create FlutterEngineGroup for spawning multiple engines efficiently
+        engineGroup = new FlutterEngineGroup(getApplicationContext());
+    }
+
+    @Override
+    public void configureFlutterEngine(@NonNull FlutterEngine flutterEngine) {
+        super.configureFlutterEngine(flutterEngine);
+
+        new MethodChannel(flutterEngine.getDartExecutor().getBinaryMessenger(), CHANNEL)
+            .setMethodCallHandler((call, result) -> {
+                if (call.method.equals("createEngine")) {
+                    try {
+                        // Create a new FlutterEngine instance
+                        // This triggers onAttachedToEngine for ALL plugins including RudderSdkFlutterPlugin
+                        FlutterEngine newEngine = engineGroup.createAndRunEngine(
+                            new FlutterEngineGroup.Options(getApplicationContext())
+                        );
+
+                        backgroundEngines.add(newEngine);
+                        result.success("Engine #" + backgroundEngines.size() + " created - onAttachedToEngine called");
+                    } catch (Exception e) {
+                        result.error("ERROR", "Failed to create engine: " + e.getMessage(), null);
+                    }
+                } else {
+                    result.notImplemented();
+                }
+            });
+    }
+
+    @Override
+    protected void onDestroy() {
+        // Clean up all background engines
+        for (FlutterEngine engine : backgroundEngines) {
+            engine.destroy();
+        }
+        backgroundEngines.clear();
+        super.onDestroy();
+    }
+}