smart_dev_pinning_plugin 5.1.0

This plugin creates a secure native TLS connection to execute HTTP requests with certificate pinning.

5.1.0

Security Fixes

• FIX (critical): Intermediate pinning (intermediateCertificate, intermediatePublicKey) now performs full X.509 path validation with the pinned intermediate as the trust anchor (webpki): basic constraints, path length, key usage, name constraints and validity of every certificate. Previously any leaf certificate issued by the same CA could act as a sub-CA and sign a forged certificate for the pinned host.
• FIX: Intermediate pinning validates the leaf identity for IP-address URLs (iPAddress SAN); it was skipped before.
• FIX: An expired or not-yet-valid pinned intermediate is rejected.
• FIX: Redirects are only followed within the origin of the original request. A cross-origin 3xx is returned to the caller (HttpError with the 3xx statusCode) instead of re-sending the body and custom headers to another host.
• FIX: Response bodies are capped at 16 MiB (ResponseTooLargeError) instead of being buffered without limit.
• FIX: A panic inside the native library is caught at the FFI boundary and reported as InternalError instead of aborting the app.

Behavior Changes

• Certificate hashes are validated up front: each must be a base64-encoded SHA-256 (32 bytes), otherwise ValidationError. Previously a typo failed at handshake time as ConnectionError.
• An unknown pinning method string (C/Swift callers) is ValidationError instead of silently using certificate.
• Cross-origin redirects are no longer followed (see above).

Features

• Swift: SmartResponse.dataEncoding, isBinary and dataBytes (binary bodies were indistinguishable from text), plus makeHttpRequestAsync for use from the main actor.
• Flutter: at most SecureClient.maxConcurrentRequests (default 8) native requests run at once; the rest queue instead of each spawning a blocked isolate.

Performance

• HTTP/2 and gzip enabled.

Tests / CI

• End-to-end tests against a local TLS server (pinning, forged chains, redirects, body limit); tautological tests removed.
• CI pins the Rust, Flutter, cbindgen and cargo-ndk versions and runs cargo audit.

5.0.0

Breaking Changes

• BREAKING: Stricter TLS verification. The handshake signature is now validated, so connections that an active man-in-the-middle could previously establish are rejected. Pins for legitimate servers are unaffected — but if you relied on the previous (weaker) behavior, those connections will now fail.
• BREAKING: The native libraries were rebuilt with a new internal signature. If you consume the plugin directly from source, rebuild the native artifacts; the published package ships the rebuilt binaries.
• BEHAVIOR: In release builds, pinning/connection errors return a generic message (full detail is kept in debug builds). Don't parse the error string for specifics like hash does not match — use errorType instead.
• BEHAVIOR: Unknown HTTP methods now return InvalidMethodError instead of silently falling back to GET.

Security Improvements

• FIX: Verify the TLS handshake signature, so a server can no longer be impersonated using only its (public) certificate.
• FIX: For intermediate pinning, cryptographically verify that the leaf certificate chains to the pinned intermediate (rejects a forged leaf bundled with a public intermediate) and that its host matches the request.
• FEAT: Error responses no longer leak internal TLS/pinning details to the caller in release builds.

Features

• FEAT: Optional timeout parameter on httpRequest to override the total request timeout (default 30s; connection timeout fixed at 10s).
• FEAT: Binary response bodies are preserved instead of being corrupted by a lossy text decode — SmartResponse.isBinary and SmartResponse.dataBytes expose the raw bytes (base64-backed).
• FEAT: Added support for the HEAD and OPTIONS methods.

Performance

• PERF: Smaller binaries and faster builds after removing unused native dependencies.

4.0.0

Breaking Changes

• BREAKING: certificateHash parameter replaced by certificateHashes: List<String>. Wrap your existing hash in a list: certificateHashes: ['your_hash'].

Security Improvements

• FEAT: Backup Pins — Accept multiple certificate hashes (certificateHashes: ['hash1', 'hash2']). Connection succeeds if ANY hash matches. Prevents app downtime during planned certificate rotations.

3.1.0

• FEAT: Added explicit support for Intermediate Certificate Pinning and Intermediate Public Key Pinning, providing a stable solution for services behind a CDN or WAF (e.g., Cloudflare, Imperva).
• FEAT: Redesigned the Flutter example app with a professional Material 3 UI, featuring interactive connection testing against all 4 pinning methods and an enhanced visual benchmark chart.

3.0.0

• Improved connection error handling — network and SSL failures now return a consistent ConnectionError type, making it easier to handle errors uniformly in your app.
• Error messages in English — all error messages returned by the native layer are now in English for better compatibility with logging and monitoring tools.
• More reliable concurrent requests — fixed an issue where concurrent requests with different pinning configurations could interfere with each other.
• Cleaner Dart API — removed internal deprecated methods that were no longer needed.

2.7.0

• FEAT(smart_dev_pinning): update license.

2.6.0

• FEAT(smart_dev_pinning): update documentation.

2.5.0

• FEAT(smart_dev_pinning): update ios to use native directly.

2.4.0

• FEAT(smart_dev_pinning): update native dependencies.

2.3.0

• FEAT(smart_grow_secure,smart_dev_pinning): update dependencies.

2.2.0

• FEAT(smart_dev_pinning_plugin): Update dependencies and improve performance.

2.1.0

• FEAT(smart_dev_pinning): add new package.

2.0.0

• BREAKING CHANGE: Added required pinningMethod parameter to httpRequest() method
• FEAT: Added PinningMethod enum with support for both public key and certificate pinning
• FEAT: Enhanced example app with modern UI and comprehensive performance benchmarking
• FEAT: Added visual performance comparison between standard HTTP and SSL pinning clients
• FEAT: Improved error handling and type safety with enum-based pinning method selection
• FEAT: Added detailed performance metrics including response times, standard deviation, and impact analysis
• DOCS: Updated README with comprehensive pinning method documentation and hash extraction commands
• DOCS: Added API reference and usage examples for both pinning methods

1.3.0

• FEAT(packages): update sonar.
• FEAT(packages): start using melos.

1.2.0

• FEAT(packages): update sonar.
• FEAT(packages): start using melos.

1.1.0

• FEAT(packages): start using melos.

1.0.0

• Initial Release