solana_kit_keys 0.9.2

Key pair and Ed25519 operations for the Solana Kit Dart SDK.

Changelog

All notable changes to this project will be documented in this file.

This changelog is managed by monochange.

0.9.2 - 2026-09-06

🐛 Fixed

Harden key verification and publication

Reject small-order Ed25519 public keys and signature nonce points, including non-canonical aliases, to prevent weak-key signature forgery. Publish key files from a mode-0700 staging directory so destination replacement cannot redirect secret bytes and readers of a file reservation cannot retain access to the completed key file.

Correct PDA documentation to state that callers may supply at most 15 seeds, reserving the sixteenth seed for the automatically appended bump.

Owner: @ifiokjr · Review: PR #238

0.9.1 - 2026-08-30

Changed

• No package-specific changes were recorded; solana_kit_keys was updated to 0.9.1 as part of group main.

0.9.0 - 2026-08-30

📖 Documentation

Unslop package docs and code comments

Rewrote every package README from a reader's perspective with verified, compilable examples, removed AI-tell phrasing from docs and code comments, and added a test that analyzes every Dart block in Markdown so examples cannot drift from the API.

Owner: @ifiokjr · Review: PR #223

0.8.0 - 2026-08-19

Changed

• No package-specific changes were recorded; solana_kit_keys was updated to 0.8.0 as part of group main.

0.7.0 - 2026-08-18

🐛 Fixed

Harden credentials, keys, transports, and untrusted RPC decoding

Align Helius signup and project provisioning with the v3 bearer-JWT API, generate valid Ed25519 authentication keypairs, validate payment inputs, and redact WebSocket credentials.

Dispose or clear SDK-owned key material deterministically, create key files exclusively with safe POSIX permissions, and preserve caller ownership of Surfpool signers.

Reject malformed RPC transaction and inner-instruction data instead of silently dropping it, expand private WebSocket literal filtering, and update JavaScript dependency overrides to releases without the audited advisories. Make the standalone Codama renderer workspace declare its own build tools and explicitly allow only esbuild's required install script.

Owner: @ifiokjr · Review: PR #213 · Related issues: #159, #163, #186, #198, #203, #204, #205, #206, #207, #208, #210, #211, #34, #37

📖 Documentation

Reformat package docs

Docs have been reformatted to remove line wrapping.

Owner: @ifiokjr · Review: PR #212

0.6.0 - 2026-08-12

🐛 Fixed

Harden cryptographic input handling

Harden keypair file writes, validate malformed mobile wallet cryptographic inputs, and update vulnerable renderer test dependencies.

Owner: @ifiokjr · Review: PR #181

📖 Documentation

Centralize package version documentation

Centralize package version metadata in versions.json and render package installation snippets from the shared MDT data source. Published package behavior is unchanged.

Owner: @ifiokjr · Review: PR #188

Point package README website badges at package docs

Updated package README website badges to link directly to each package's docs catalog entry and added missing package entries to the documentation website catalog/index.

Owner: @ifiokjr · Review: PR #192

0.5.0 - 2026-06-01

💥 Breaking Change

Raise minimum Dart SDK to 3.12

Raise the minimum supported Dart SDK constraint to ^3.12.0 across public Dart packages.

This is a breaking change because consumers must use Dart 3.12 or newer. Flutter consumers must use a Flutter SDK that bundles Dart 3.12 or newer.

environment:
  sdk: ^3.12.0

Owner: Ifiok Jr. · Introduced in: 32d5d36

🧪 Testing

Improve test coverage to 95%+ across all packages

Added 500+ tests covering equality/hashCode/toString, codec edge cases, error paths, and constructor variants. Removed dead code in fast_stable_stringify. Fixed concurrent modification bug in subscribable.

Owner: Ifiok Jr. · Introduced in: 48216f9 · Last updated in: b7f5419

0.4.0 - 2026-05-30

📝 Changed

Restructure release groups

Move program-specific and domain-specific packages out of the main release group into standalone release schedules with independent versioning. Core SDK packages remain synchronized in the main group.

Owner: Ifiok Jr. · Introduced in: fccec7f · Last updated in: 93b3cd3

🐛 Fixed

Add per-package coverage badges

Add codecov flags and per-package coverage badges to all package READMEs.

Owner: Ifiok Jr. · Introduced in: bed1b1f · Last updated in: 93b3cd3

Add key-pair filesystem and grinding compatibility helpers

Owner: Ifiok Jr. · Introduced in: 9ee2e44 · Last updated in: a526ea3

Zero KeyPair private key memory on GC

SEC-02: Add Finalizer-based memory zeroing for KeyPair private keys.

• Added Finalizer that zeros internal key bytes when KeyPair is garbage collected
• Added dispose() method to explicitly zero key bytes on demand
• Added isDisposed property to check if dispose() has been called
• privateKey and publicKey getters now throw StateError after dispose()
• Documented limitations of Dart's GC-based finalization
• 4 new tests covering dispose behavior

Owner: Ifiok Jr. · Introduced in: 3c175c3 · Last updated in: 12316d5