bug: [packaging] editing requirements.txt does not trigger pip reinstall (stale hash), produces APK with missing/empty site-packages

Duplicate Check

• I have searched the opened issues and there are no duplicates

Describe the bug

flet build apk: editing requirements.txt does not trigger pip reinstall (stale hash), produces APK with missing/empty site-packages

Affected versions

• flet 0.85.3 (verified locally)
• flet 1.0.5 / main branch (code path unchanged — verified against sdk/python/packages/flet-cli/src/flet_cli/commands/build_base.py on GitHub main as of 2026-10-24)
• Platform: Windows 10 Pro (10.0.19045), flet build apk (Android target)

Summary

When requirements.txt is modified between builds, flet build apk does NOT
re-run pip install. The incremental-build hash that decides whether to pass
--skip-site-packages only includes the path of requirements.txt, not
its contents. The branch that hashes the file contents is gated behind
self.verbose > 1, so in a default (verbose=0) build the contents are never
hashed, and editing dependencies silently reuses stale site-packages.

This is worse than "stale": if build/site-packages was removed (or the
previous build failed partway), the skip logic still fires, and the resulting
APK contains no third-party packages at all. The app then crashes at
import time (e.g. ModuleNotFoundError: No module named 'certifi'), and on
Android the error is swallowed — the user just sees a white screen.

Related issues (same symptoms, root cause never identified)

Several closed issues report the same failure mode, all resolved with
"delete the build directory" without tracing the cause:

• #5376 ModuleNotFoundError: No module named 'certifi' — identical traceback
  (even the same line 77) to what we hit; closed without root cause
• #6049 gTTS installed but missing from APK (CI had cached build/)
• #6213, #5113, #5952 various ModuleNotFoundError after adding deps
• #2406, #2611 same on Windows builds

As long as the hash ignores requirements.txt contents, any user who edits
dependencies and has a warm build/ cache (or clears site-packages but
not .hash) will hit this again.

Root cause (source, build_base.py)

Contents only hashed under verbose (0.85.3 line ~1941 / main line ~2610):

elif requirements_txt.exists():
    if self.verbose > 1:                     # <-- gate
        with open(requirements_txt, encoding="utf-8") as f:
            reqs_txt_contents = f.read()
            ...
            hash.update(reqs_txt_contents)   # <-- only reached with -vv
    package_args.extend(["-r", "-r", "-r", str(requirements_txt)])

Skip decision (0.85.3 line ~2051 / main line ~2808):

for arg in package_args:        # <-- only "-r <path>", "--exclude ...", etc.
    hash.update(arg)

if not dev_packages_configured:
    if not hash.has_changed():
        package_args.append("--skip-site-packages")   # <-- pip skipped

Since package_args contains only the path string of requirements.txt,
editing its contents changes nothing in the hash → --skip-site-packages is
appended → pip install never runs.

Impact note

On Android the resulting failure mode is severe for debugging: the missing
module crashes Python at import time, the error is not surfaced in logcat, and
the app renders a blank screen. It took considerable effort to trace this back
to the packaging cache. (In our case certifi was missing from the APK while
present in requirements.txt-installed environments, since build/site-packages
had been cleared while the hash stamp remained.)

Code sample

Steps to reproduce

mkdir repro && cd repro
# main.py — any minimal flet app
cat > main.py <<'EOF'
import flet as ft

def main(page: ft.Page):
    page.add(ft.Text("hello"))

ft.run(main)
EOF

printf 'flet==0.85.3\nhttpx==0.28.1\n' > requirements.txt

# Build 1: baseline — pip runs (~1 min "Packaging Python app...")
flet build apk --yes --project repro --bundle-id com.test.repro
# -> build/site-packages contains httpx, certifi, etc.

# Build 2: change requirements.txt CONTENTS (path unchanged!)
printf 'flet==0.85.3\nhttpx==0.28.1\npyDes\n' > requirements.txt

flet build apk --yes --project repro --bundle-id com.test.repro
# Observe: "Packaging Python app..." completes in ~2 seconds (vs ~60s),
# no pip output; build/site-packages still has the OLD package set.

To reproduce

Measured reproduction (2026-10-24, flet 0.85.3, Windows 10, Python 3.14 host)

pyDes was added to requirements.txt between builds; after build 2 it is
still absent from build/site-packages, and the .hash/package stamp was
silently rewritten — so build 3 will skip pip again.

Also reproducible by deleting build/site-packages between builds: build 2
then produces an APK whose Python bundle has no third-party packages, and
the app fails at import. This exact sequence (edit requirements → clear
build/site-packages but not build/.hash → rebuild) produced an APK
missing certifi and a blank screen on Android, which is how the issue was
found.

Expected behavior

Expected behavior

Editing requirements.txt should be detected and pip install re-run.

Screenshots / Videos

Operating System

Windows

Operating system details

10 pro

Flet version

0.85.3

Regression

I'm not sure / I don't know

Suggestions

Suggested fix

Unconditionally hash the contents (the verbose > 1 gate should only control
logging the contents, not whether they're hashed):

elif requirements_txt.exists():
    with open(requirements_txt, encoding="utf-8") as f:
        reqs_txt_contents = f.read()
        if self.verbose > 1:
            console.log(f"Contents of requirements.txt: {reqs_txt_contents}",
                        style=verbose2_style)
        hash.update(reqs_txt_contents)

Alternatively, hash a stat of the file (mtime + size), or always pass the file
to serious_python and let it decide.## Workaround

Delete build/ (or at least build/.hash/) after changing
requirements.txt, or run flet build apk -vv ... (contents then enter the
hash).

Logs

[Paste your logs here]

Additional details

No response