The last I heard about that it turned out that the inclusion of a non free dependency was a packaging mistake and has been supposedly fixed

“The sdk-secrets repository and packages will no longer be referenced from the client apps, since that code is not used there.”