quickpatch_cli 1.6.116

QuickPatch — self-hosted OTA code-push for Flutter apps.

1.6.116

• Patch signing fix (security): ensure the patch public key is embedded into the app before every Android and iOS build, so on-device patch signature verification is actually enforced. Previously the key could be omitted for QuickPatch projects, leaving the on-device updater unable to verify patches (effectively unsigned). Device-verified on a physical Android device: a patch signed with an untrusted key is now rejected at boot ("Patch signature is invalid"), while one signed with the trusted key applies normally. Applied automatically and idempotently, so existing installs are fixed on the next build.
• Forward additional trusted public keys (for signing-key rotation) to the build environment, so a rotated key can be trusted before the old one is retired.

1.6.115

• Self-host without an env var: the storage/mirror base URL now falls back to quickpatch.yaml's base_url (after the QUICKPATCH_HOSTED_URL env override, before the hosted default), so a base_url in your config is enough to point both the build-time engine downloads and the on-device updater at your own server — no manual QUICKPATCH_HOSTED_URL export. With neither set, behaviour is unchanged.

1.6.114

• Fix --version reporting: version.dart was not bumped in the previous two releases, so quickpatch --version (and the x-cli-version request header) reported a stale version. Now synced to the package version.

1.6.113

• Cleanup: removed the legacy config-file fallback (projects use quickpatch.yaml exclusively) and tidied source comments. No functional change for existing projects.

1.6.112

• Fix onboarding crash: quickpatch --version and quickpatch doctor no longer fail with a cache-corrupted error on a fresh install before the pinned Flutter/engine is downloaded. The engine revision now falls back to the install-root pin, and both commands degrade to a readable "not installed (downloaded on first release/patch)" instead of throwing.

1.6.111

• iOS arbitrary code push (--interpreter): release/patch iOS apps with arbitrary Dart changes (new widgets, screens, control-flow) over the air via an on-device Dart interpreter.
• Staged OTA: interpreter patches are signature-verified, staged to disk on download, and applied at the next launch's first frame — no flash of the old UI, no live reassemble.
• quickpatch upgrade: now performs a real git fast-forward + rebuild instead of printing an upgrade hint.
• Fix: declare asn1lib as a direct dependency (used for patch-signature key parsing).

1.6.109

• flutter versions list: Show newest versions first. Remove .reversed since server already returns newest-first order.

1.6.108

• Fix flutter versions list: Always fetch from production server using a fixed URL — previous version used the project-level hostedUri which caused silent fallback to local git branches.

1.6.107

• flutter versions list: Now fetches supported versions directly from your QuickPatch server instead of reading all engine fork branches. Only versions mirrored in R2 are shown — the ones you actually support. Falls back to local git branch listing if server is unreachable.

1.6.106

• Fix: When QUICKPATCH_HOSTED_URL is not set, the CLI now shows a clear error with the exact export command (platform-aware: export on macOS/Linux, $env: on Windows) instead of a cryptic SocketException.

1.6.105

• Login: Replaced browser OAuth flow with API key authentication. Run quickpatch login and paste your key from the dashboard.
• Upgrade: quickpatch upgrade now shows the correct dart pub global activate quickpatch_cli instruction instead of crashing with a git error.
• Published to pub.dev — install and upgrade via dart pub global activate quickpatch_cli.