A Missing Maven Dependency in Firebase Auth Just Broke Kotlin Builds Worldwide

Any Android or Flutter team upgrading to Kotlin 2.4 and using Firebase Auth with SAM conversions will hit a hard build failure unless they pin explicit types or ensure `checker-qual` arrives transitively. The fix is trivial once diagnosed, but the root cause — a missing POM dependency in Google's own SDK — went unnoticed for years, which erodes trust in upstream release hygiene.

Firebase's `firebase-auth` AAR has shipped for years with class files that reference a Checker Framework annotation (`@UnknownInitialization`) while its POM never declared the `checker-qual` dependency. The gap was harmless until two triggers landed at once: FlutterFire rewrote `firebase_auth` from Java to Kotlin, introducing SAM lambdas that rely on type inference, and Kotlin 2.4 upgraded the missing-annotation scenario from a warning to a hard compilation error.

The result is a `Type annotation class … is inaccessible` error that hits any Kotlin project using `FirebaseAuth.IdTokenListener` or `AuthStateListener` with inferred parameter types under Kotlin 2.4, unless another dependency happens to pull in `checker-qual` transitively. FlutterFire's fix sidesteps the upstream gap entirely by adding explicit parameter types (`auth: FirebaseAuth`) so the compiler never needs to read the broken annotation path.

The episode exposes a brittle supply chain: a metadata defect in a Google SDK sat dormant for years, surfaced only when a downstream rewrite and a compiler upgrade combined. Former Flutter founder Eric also called out Firebase's architecture publicly, noting the irony of Google pushing R8 optimization on developers while its own SDK ships with unresolved compile dependencies.