v2.1.2 of appmsgr_flutter

2026-04-24T19:23:24.643426Z

2.1.2 was published on Apr 24, 2026.

Changelog excerpt:
### Security

- **HTTPS enforcement on REST base URL**: `AppMsgrClient`now throws `ArgumentError`in release builds if `baseUrl`starts with `http://`. Previously only the GraphQL URL was checked; the REST path would have sent `Authorization: Bearer …`over plaintext.
- **Auth fields privatized**: `apiKey`and `userToken`fields on `AppMsgrClient`are now library-private (`_apiKey`, `_userToken`) so they are not visible to crash reporters, DevTools inspection, or third-party widgets that serialize the client object. The class is now marked `final`to prevent subclass-based header overrides.
- **CR/LF header-injection guard**: auth tokens containing `\r`or `\n`are now rejected at client construction and in `BaseService`/ the GraphQL client.
- **URL-encoded emoji path segment**: `ReactionService.getReactionUsers`now `Uri.encodeComponent`s the emoji before inserting it into the URL, preventing path-traversal via adversarial emoji input.
- **WebSocket URL rewrite fix**: the http(s) → ws(s) conver[...]