Flutter 3.47.8 (stable) and 3.50.0-0.2.pre (beta) shipped as a security release. They block certificate authority keys from eMudhra that were reported as compromised. The Flutter team's advice is short: if your app targets Android, Windows or Linux, run flutter upgrade and rebuild.
Why only Android, Windows and Linux
On iOS and macOS, Dart's HttpClient asks the operating system whether a server certificate is trusted, and Apple ships its own revocations. On Android, Windows and Linux, a Flutter app checks certificates against the root store that is compiled into the engine. An app built with an older engine keeps trusting the compromised keys until you ship a new build. A user who never updates the app keeps that trust forever.
Practically, an attacker holding those keys could issue a certificate for your API domain. An old build would accept it, and anything the app sends or receives over HTTPS could be read or changed.
What to do
flutter upgrade # 3.47.8 or later on stable
flutter --version # check the engine really moved
flutter build appbundle # and every other target you ship
Then publish the new builds. A hotfix-only release is fine. Nothing in your Dart code has to change.
If your CI pins a Flutter version (subosito/flutter-action with flutter-version, an FVM config, a Docker image), bump the pin there too, or the next release will be built with the old engine again.
What this means for localisation
Live translation updates are an HTTPS call like any other. With flutter_localisation, the app fetches new strings from api.flutterlocalisation.com. On an Android build made with an older engine, that call trusts the same certificate list as the rest of your app, so the fix matters there too. Rebuilding with 3.47.8 or later covers it. No package update is needed.
While you are upgrading: on current Flutter, synthetic-package: true in l10n.yaml stops the build, and imports of package:flutter_gen/gen_l10n/... no longer resolve. fl doctor --fix from our CLI finds and fixes both. See migrating off the synthetic package for the details.