firebase / firebase/firebase-android-sdk

firebase-auth publishes @UnknownInitialization but does not declare checker-qual, breaking Kotlin consumers

Open
#8,557 2 comments 0 reactions 0 assignees View on GitHub
api: auth type: bug
Dominant language
Java
Stars
2.6k
Forks
710
Avg merge
2d 23h
Merged PRs (30d)
34

Description

### [READ] Step 1: Are you in the right place?

Yes — this is a defect in the published `com.google.firebase:firebase-auth` artifact metadata.

### [REQUIRED] Step 2: Describe your environment

* Android Studio version: n/a (Gradle CLI)
* Firebase Component: Authentication (`com.google.firebase:firebase-auth:24.2.0`, via `firebase-bom:34.18.0`)
* Component version: 24.2.0
* Kotlin: 2.4.10 · AGP: 9.4.0-rc01 · Gradle: 9.7.1 · JDK 21

### [REQUIRED] Step 3: Describe the problem

`firebase-auth` publishes classes annotated with `org.checkerframework.checker.initialization.qual.UnknownInitialization`, but its POM does not declare `org.checkerframework:checker-qual`. Consumers therefore have no way to resolve that annotation, and any Kotlin code that compiles against the annotated API and lets a type be **inferred** fails to compile.

Confirmed by scanning the artifact contents — the annotation reference is inside `firebase-auth` itself, not a transitive dependency:

```
$ unzip -p firebase-auth-24.2.0.aar classes.jar | strings | grep UnknownInitialization
# present in 24.2.0 and 24.1.0
```

and it is absent from the published POM (all 17 declared dependencies checked; `androidx.*`, `play-services-*`, `firebase-*`, `kotlin-stdlib` — no `checker-qual`).

Nothing else on the compile classpath supplies it either. `firebase-auth` pulls only the `com.google.guava:listenablefuture` stub, not full Guava — and full Guava is what historically put `checker-qual` on the classpath transitively. That is presumably why this was latent: the annotation is present in 24.1.0 as well, so an unrelated dependency change is what removed the accidental path to it.

**Steps to reproduce:**

Compile Kotlin against `FirebaseAuth.IdTokenListener` with an inferred lambda parameter, with `checker-qual` absent from the classpath:

```kotlin
FirebaseAuth.IdTokenListener { auth -> // `auth` type inferred
// ...
}
```

**Relevant Code / error:**

```
Type annotation class 'org.checkerframework.checker.initialization.qual.UnknownInitialization'
of the inferred type is inaccessible. Check the module classpath for missing or conflicting dependencies.
```

This reproduces through the official Flutter plugin (`firebase_auth` 6.6.0), whose `IdTokenChannelStreamHandler.kt:23` is exactly that shape — `:firebase_auth:compileDebugKotlin` fails outright.

Note `javac` tolerates this (the JLS says unresolvable annotations are ignored), so Java consumers do not notice; Kotlin needs the annotation to resolve the inferred type, so only Kotlin consumers break.

**Workaround** (in a consumer's build, for anyone finding this):

```kotlin
dependencies { compileOnly("org.checkerframework:checker-qual:3.49.5") }
```

**Suggested fix:** declare `checker-qual` in `firebase-auth`'s POM so it lands on consumers' compile classpath, or strip the annotation from the published class files if it is not meant to be part of the public API surface.

Contributor guide

Open the contributing guide

Research direction

Inspect the published firebase-auth-24.2.0 AAR's classes.jar and POM, then trace the firebase-auth dependency declaration that produces that metadata. Reproduce the Kotlin inference failure with the reported IdTokenListener lambda and verify that a clean consumer build succeeds without the compileOnly checker-qual workaround.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java, kotlin
Domain
build-system, mobile-dev
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.