Bdaya-Dev · github-actions · Jul 11, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
diff --git a/packages/crypto_keys_plus/CHANGELOG.md b/packages/crypto_keys_plus/CHANGELOG.md
@@ -1,3 +1,12 @@
+## 0.6.0
+
+> Note: This release has breaking changes.
+
+ - **FIX**: resolve all four library bugs; drive honest unit coverage to ~95% ([#368](https://github.com/Bdaya-Dev/oidc/issues/368)). ([c86bee17](https://github.com/Bdaya-Dev/oidc/commit/c86bee17189a0a70fee947c685e91a55062b1d35))
+ - **FIX**(crypto_keys_plus): resolve pub.dev publish dry-run warnings. ([5bee9a89](https://github.com/Bdaya-Dev/oidc/commit/5bee9a8954e4fc5412f20db826aa7fe053eebabb))
+ - **FEAT**(crypto): RSASSA-PSS (PS256/384/512) + EdDSA/Ed25519. ([6c5c6741](https://github.com/Bdaya-Dev/oidc/commit/6c5c674149fe0504207c95aefbda7fedfca72ae9))
+ - **BREAKING** **FEAT**: consolidate jose_plus, crypto_keys_plus, x509_plus into the workspace. ([3fffc6cd](https://github.com/Bdaya-Dev/oidc/commit/3fffc6cd51f2abb0ead643acc2ec4d5741fac8e5))
+
 ## 0.5.0
   -   **UPGRADE**: migrated to pointycastle 4.0.0.
 

diff --git a/packages/crypto_keys_plus/pubspec.yaml b/packages/crypto_keys_plus/pubspec.yaml
@@ -1,6 +1,6 @@
 name: crypto_keys_plus
 description: A library for doing cryptographic signing/verifying and encrypting/decrypting.
-version: 0.5.0
+version: 0.6.0
 repository: https://github.com/Bdaya-Dev/oidc/tree/main/packages/crypto_keys_plus
 homepage: https://bdaya-dev.github.io/oidc/
 funding:

diff --git a/packages/jose_plus/CHANGELOG.md b/packages/jose_plus/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.6.0
+
+> Note: This release has breaking changes.
+
+ - **FIX**: resolve all four library bugs; drive honest unit coverage to ~95% ([#368](https://github.com/Bdaya-Dev/oidc/issues/368)). ([c86bee17](https://github.com/Bdaya-Dev/oidc/commit/c86bee17189a0a70fee947c685e91a55062b1d35))
+ - **FIX**(ci): stop swallowing web test failures; pin dart:io fixture tests to vm ([#363](https://github.com/Bdaya-Dev/oidc/issues/363)). ([6102d835](https://github.com/Bdaya-Dev/oidc/commit/6102d8353b0d330f888ea8b8e9b4c52937be2236))
+ - **FIX**(release): add package-name entrypoints for jose_plus and x509_plus. ([4bbcb7f3](https://github.com/Bdaya-Dev/oidc/commit/4bbcb7f3df69cf393be29bd5997f49c15add7ff4))
+ - **FIX**(jose_plus): normalize crypto_keys_plus/x509_plus constraints to caret syntax. ([d0a1d55d](https://github.com/Bdaya-Dev/oidc/commit/d0a1d55da2507e2f12b1244dcedaa1481fad1aed))
+ - **FEAT**(crypto): RSASSA-PSS (PS256/384/512) + EdDSA/Ed25519. ([6c5c6741](https://github.com/Bdaya-Dev/oidc/commit/6c5c674149fe0504207c95aefbda7fedfca72ae9))
+ - **BREAKING** **FEAT**: consolidate jose_plus, crypto_keys_plus, x509_plus into the workspace. ([3fffc6cd](https://github.com/Bdaya-Dev/oidc/commit/3fffc6cd51f2abb0ead643acc2ec4d5741fac8e5))
+
 ## 0.4.8
  - **FIX**: JWE JSON parsing now handles missing `recipients` / `header` by deriving a single recipient from the protected header and validates absent `encrypted_key` for non-`dir` algorithms.
  - **FEAT**: Support unpadded Base64URL protected header (new parsing test). 

diff --git a/packages/jose_plus/pubspec.yaml b/packages/jose_plus/pubspec.yaml
@@ -1,6 +1,6 @@
 name: jose_plus
 description: Javascript Object Signing and Encryption (JOSE) library supporting JWE, JWS, JWK and JWT
-version: 0.5.0
+version: 0.6.0
 repository: https://github.com/Bdaya-Dev/oidc/tree/main/packages/jose_plus
 homepage: https://bdaya-dev.github.io/oidc/
 funding:
@@ -11,10 +11,10 @@ environment:
   sdk: ">=3.5.0 <4.0.0"
 
 dependencies:
-  crypto_keys_plus: ^0.5.0
+  crypto_keys_plus: ^0.6.0
   meta: ^1.1.6
   typed_data: ^1.0.0
-  x509_plus: ^0.3.3
+  x509_plus: ^0.4.0
   http: ">=0.13.0 <2.0.0"
   http_parser: ^4.0.0
   asn1lib: ^1.0.0

diff --git a/packages/oidc/CHANGELOG.md b/packages/oidc/CHANGELOG.md
@@ -1,3 +1,27 @@
+## 0.15.0
+
+> Note: This release has breaking changes.
+
+ - **FIX**: resolve all four library bugs; drive honest unit coverage to ~95% ([#368](https://github.com/Bdaya-Dev/oidc/issues/368)). ([c86bee17](https://github.com/Bdaya-Dev/oidc/commit/c86bee17189a0a70fee947c685e91a55062b1d35))
+ - **FIX**(oidc_darwin): implement flowTimeoutSeconds for the Apple ASWebAuthenticationSession flow. ([482f0186](https://github.com/Bdaya-Dev/oidc/commit/482f0186b8cdb37d309118de187e1c8496555d9a))
+ - **FIX**(example): add patrol RunnerUITests UI-testing target for iOS. ([21b740f6](https://github.com/Bdaya-Dev/oidc/commit/21b740f645be41a0792299660d2a96db26fb378a))
+ - **FIX**(example): wrap patrol conformance placeholder with SharedValue.wrapApp. ([831df91c](https://github.com/Bdaya-Dev/oidc/commit/831df91c7f041a96af10bf1c80ef92f49d45a2c8))
+ - **FIX**(example): use FlutterFragmentActivity for Auth Tab (ComponentActivity). ([e6e9be47](https://github.com/Bdaya-Dev/oidc/commit/e6e9be47683d80897a6dce6f92433408c89155f4))
+ - **FIX**: pre-v1 correctness — certification claim, license, Android queries, honest native option docs. ([3b8ef447](https://github.com/Bdaya-Dev/oidc/commit/3b8ef447f2a1c0af68ec6711c77d435531fb827f))
+ - **FIX**(spm,native): SwiftPM layout migration + conformance fixes; fix Android build. ([47f7bd25](https://github.com/Bdaya-Dev/oidc/commit/47f7bd25feb5d4b7a2e3db67165a44ecdf4dae29))
+ - **FIX**(native): harden iOS threading, simplify Android redirect to one-line setup. ([a7553f32](https://github.com/Bdaya-Dev/oidc/commit/a7553f326c1d67ac2bd057b0864688d73df24661))
+ - **FIX**: handle refresh responses without id_token. ([4af363be](https://github.com/Bdaya-Dev/oidc/commit/4af363bed630d18394b28af1664f334aca3df8d9))
+ - **FEAT**(observability): native browser events via the existing OidcEvent stream (Phase 3). ([91d1f5bd](https://github.com/Bdaya-Dev/oidc/commit/91d1f5bdfa1526aec170474181ec71ad1bf38c59))
+ - **BREAKING** **REFACTOR**: remove rxdart; adopt bdaya_shared_value ^5.0.0. ([0d65d7fd](https://github.com/Bdaya-Dev/oidc/commit/0d65d7fde062e2db7ffbdd31a47735c59954045a))
+ - **BREAKING** **FEAT**(oidc_core): remove the strictJwtVerification fail-open opt-out. ([ee2146f9](https://github.com/Bdaya-Dev/oidc/commit/ee2146f9fa966c352a7c751673550bdcb5e7c0a5))
+ - **BREAKING** **FEAT**(oidc_android): switch to Auth Tab only, remove Custom Tabs path. ([05bf0181](https://github.com/Bdaya-Dev/oidc/commit/05bf01811e299c472d49efb303fb657c939f0bd4))
+ - **BREAKING** **FEAT**(oidc_android): add flowTimeoutSeconds to fix headless CI hang. ([01c844f5](https://github.com/Bdaya-Dev/oidc/commit/01c844f5bd98a3d983b9e50f9fa2192ed7013e50))
+ - **BREAKING** **FEAT**: merge oidc_ios + oidc_macos into a unified oidc_darwin plugin. ([db73858e](https://github.com/Bdaya-Dev/oidc/commit/db73858e71b3b869326867b05b9d1ead3629acb9))
+ - **BREAKING** **FEAT**(options): redesign native options API (v1 clean break, no AppAuth framing). ([a78954fe](https://github.com/Bdaya-Dev/oidc/commit/a78954feb4c4c6dfb0abc15f7e0a308be74d4e95))
+ - **BREAKING** **FEAT**(oidc_macos): first-party ASWebAuthenticationSession; drop flutter_appauth. ([dc13f411](https://github.com/Bdaya-Dev/oidc/commit/dc13f411a3bfca4572a0f0e8fea2705365314d3c))
+ - **BREAKING** **FEAT**: consolidate jose_plus, crypto_keys_plus, x509_plus into the workspace. ([3fffc6cd](https://github.com/Bdaya-Dev/oidc/commit/3fffc6cd51f2abb0ead643acc2ec4d5741fac8e5))
+ - **BREAKING** **CHORE**: v1 dependency upgrade + drop the pigeon global-tool wrapper. ([45b62a3e](https://github.com/Bdaya-Dev/oidc/commit/45b62a3ef3f5b42cfb590111c9e37e144bbc11b0))
+
 ## 0.14.0+2
 
  - **DOCS**: remove logo branding from screenshots. ([2acf65d3](https://github.com/Bdaya-Dev/oidc/commit/2acf65d34fb47c0449653a73373168df3deb1735))

diff --git a/packages/oidc/example/pubspec.yaml b/packages/oidc/example/pubspec.yaml
@@ -21,8 +21,8 @@ dependencies:
   logging: ^1.2.0
   oidc:
     path: ../
-  oidc_core: ^0.16.1+1
-  oidc_default_store: ^0.6.0+2
+  oidc_core: ^0.17.0
+  oidc_default_store: ^0.6.1
 dev_dependencies:
   archive: ^4.0.7
   # integration_test + flutter_test back the macOS e2e job only

diff --git a/packages/oidc/pubspec.yaml b/packages/oidc/pubspec.yaml
@@ -1,6 +1,6 @@
 name: oidc
 description: A comprehensive OpenIdConnect plugin that works on all platforms (android, ios, windows, linux, web, macos)
-version: 0.14.0+2
+version: 0.15.0
 repository: https://github.com/Bdaya-Dev/oidc/tree/main/packages/oidc
 topics: ["oidc", "openidconnect", "oauth", "authentication"]
 homepage: https://bdaya-dev.github.io/oidc/
@@ -30,16 +30,16 @@ dependencies:
   flutter:
     sdk: flutter
   # Endorsed packages
-  oidc_android: ^0.8.0+3
-  oidc_core: ^0.16.1+1
-  oidc_darwin: ^1.0.0
-  oidc_linux: ^0.5.0+3
-  oidc_platform_interface: ^0.7.0+3
-  oidc_web: ^0.7.0+3
-  oidc_windows: ^0.4.0+3
+  oidc_android: ^0.9.0
+  oidc_core: ^0.17.0
+  oidc_darwin: ^2.0.0
+  oidc_linux: ^0.5.0+4
+  oidc_platform_interface: ^0.8.0
+  oidc_web: ^0.7.1
+  oidc_windows: ^0.4.0+4
   # ====================
   http: ^1.1.0
-  jose_plus: ^0.5.0
+  jose_plus: ^0.6.0
   retry: ^3.1.2
   logging: ^1.2.0
   json_annotation: ^4.12.0

diff --git a/packages/oidc_android/CHANGELOG.md b/packages/oidc_android/CHANGELOG.md
@@ -1,3 +1,23 @@
+## 0.9.0
+
+> Note: This release has breaking changes.
+
+ - **FIX**: resolve all four library bugs; drive honest unit coverage to ~95% ([#368](https://github.com/Bdaya-Dev/oidc/issues/368)). ([c86bee17](https://github.com/Bdaya-Dev/oidc/commit/c86bee17189a0a70fee947c685e91a55062b1d35))
+ - **FIX**(example): use FlutterFragmentActivity for Auth Tab (ComponentActivity). ([e6e9be47](https://github.com/Bdaya-Dev/oidc/commit/e6e9be47683d80897a6dce6f92433408c89155f4))
+ - **FIX**(oidc_android): remove duplicate mainHandler declaration. ([ae0f70c2](https://github.com/Bdaya-Dev/oidc/commit/ae0f70c20b4c011f35365be44673713622eeacc9))
+ - **FIX**(oidc_android): use flowId self-check instead of Handler.removeCallbacks. ([c8f585a3](https://github.com/Bdaya-Dev/oidc/commit/c8f585a36912af3ef379fdb88eb046035b8d22dd))
+ - **FIX**: pre-v1 correctness — certification claim, license, Android queries, honest native option docs. ([3b8ef447](https://github.com/Bdaya-Dev/oidc/commit/3b8ef447f2a1c0af68ec6711c77d435531fb827f))
+ - **FIX**(native): harden iOS threading, simplify Android redirect to one-line setup. ([a7553f32](https://github.com/Bdaya-Dev/oidc/commit/a7553f326c1d67ac2bd057b0864688d73df24661))
+ - **FEAT**(android): Auth Tab redirect-capture path (Phase 4, opt-in). ([0b80aaf2](https://github.com/Bdaya-Dev/oidc/commit/0b80aaf2a253f31f7b4fee62e91a0f10fdd1fa25))
+ - **FEAT**(observability): native browser events via the existing OidcEvent stream (Phase 3). ([91d1f5bd](https://github.com/Bdaya-Dev/oidc/commit/91d1f5bdfa1526aec170474181ec71ad1bf38c59))
+ - **FEAT**(android): apply typed Custom Tabs options natively (Phase 1). ([10e903eb](https://github.com/Bdaya-Dev/oidc/commit/10e903ebcbdb7fa8cb33c7f2f4d30b58db26d33e))
+ - **BREAKING** **REFACTOR**: remove rxdart; adopt bdaya_shared_value ^5.0.0. ([0d65d7fd](https://github.com/Bdaya-Dev/oidc/commit/0d65d7fde062e2db7ffbdd31a47735c59954045a))
+ - **BREAKING** **FEAT**(oidc_android): switch to Auth Tab only, remove Custom Tabs path. ([05bf0181](https://github.com/Bdaya-Dev/oidc/commit/05bf01811e299c472d49efb303fb657c939f0bd4))
+ - **BREAKING** **FEAT**(oidc_android): add flowTimeoutSeconds to fix headless CI hang. ([01c844f5](https://github.com/Bdaya-Dev/oidc/commit/01c844f5bd98a3d983b9e50f9fa2192ed7013e50))
+ - **BREAKING** **FEAT**: merge oidc_ios + oidc_macos into a unified oidc_darwin plugin. ([db73858e](https://github.com/Bdaya-Dev/oidc/commit/db73858e71b3b869326867b05b9d1ead3629acb9))
+ - **BREAKING** **FEAT**(native): migrate native transport to Pigeon + automate codegen. ([fc7606f3](https://github.com/Bdaya-Dev/oidc/commit/fc7606f3329cc493281a438ff76482436b018709))
+ - **BREAKING** **FEAT**(oidc_android): replace flutter_appauth with first-party Custom Tabs auth. ([ddd64296](https://github.com/Bdaya-Dev/oidc/commit/ddd642968ca95cc57f0745d3ec59b5d9bc3c290f))
+
 ## 0.8.0+3
 
  - **DOCS**: remove logo branding from screenshots. ([2acf65d3](https://github.com/Bdaya-Dev/oidc/commit/2acf65d34fb47c0449653a73373168df3deb1735))

diff --git a/packages/oidc_android/example/pubspec.yaml b/packages/oidc_android/example/pubspec.yaml
@@ -15,9 +15,9 @@ dependencies:
   logging: ^1.2.0
   oidc_android:
     path: ../
-  oidc_core: ^0.16.1+1
-  oidc_default_store: ^0.6.0+2
-  oidc_platform_interface: ^0.7.0+3
+  oidc_core: ^0.17.0
+  oidc_default_store: ^0.6.1
+  oidc_platform_interface: ^0.8.0
 
 dev_dependencies:
   flutter_driver:

diff --git a/packages/oidc_android/pubspec.yaml b/packages/oidc_android/pubspec.yaml
@@ -1,6 +1,6 @@
 name: oidc_android
 description: Android implementation of the oidc plugin
-version: 0.8.0+3
+version: 0.9.0
 repository: https://github.com/Bdaya-Dev/oidc/tree/main/packages/oidc_android
 homepage: https://bdaya-dev.github.io/oidc/
 topics: ["oidc", "openidconnect", "oauth", "authentication"]
@@ -22,8 +22,8 @@ flutter:
 dependencies:
   flutter:
     sdk: flutter
-  oidc_core: ^0.16.1+1
-  oidc_platform_interface: ^0.7.0+3
+  oidc_core: ^0.17.0
+  oidc_platform_interface: ^0.8.0
 
 dev_dependencies:
   flutter_test:

diff --git a/packages/oidc_cli/CHANGELOG.md b/packages/oidc_cli/CHANGELOG.md
@@ -1,3 +1,11 @@
+## 0.1.0
+
+> Note: This release has breaking changes.
+
+ - **FIX**: resolve all four library bugs; drive honest unit coverage to ~95% ([#368](https://github.com/Bdaya-Dev/oidc/issues/368)). ([c86bee17](https://github.com/Bdaya-Dev/oidc/commit/c86bee17189a0a70fee947c685e91a55062b1d35))
+ - **FEAT**(storage): harden token storage at rest (RFC 9700 §4.9.3). ([76111b4a](https://github.com/Bdaya-Dev/oidc/commit/76111b4a1022a140c0b510e088becaed54835c0f))
+ - **BREAKING** **CHORE**: v1 dependency upgrade + drop the pigeon global-tool wrapper. ([45b62a3e](https://github.com/Bdaya-Dev/oidc/commit/45b62a3ef3f5b42cfb590111c9e37e144bbc11b0))
+
 ## 0.0.2+2
 
  - **DOCS**: remove logo branding from screenshots. ([2acf65d3](https://github.com/Bdaya-Dev/oidc/commit/2acf65d34fb47c0449653a73373168df3deb1735))

diff --git a/packages/oidc_cli/pubspec.yaml b/packages/oidc_cli/pubspec.yaml
@@ -1,6 +1,6 @@
 name: oidc_cli
 description: A small provider-agnostic CLI for authenticating against an OpenID Connect (OIDC) provider.
-version: 0.0.2+2
+version: 0.1.0
 repository: https://github.com/Bdaya-Dev/oidc/tree/main/packages/oidc_cli
 homepage: https://bdaya-dev.github.io/oidc/
 topics: ["oidc", "openidconnect", "oauth", "authentication"]
@@ -14,8 +14,8 @@ dependencies:
   cli_completion: ^0.5.1
   http: ^1.1.0
   mason_logger: ^0.3.3
-  oidc_core: ^0.16.1+1
-  oidc_loopback_listener: ^0.3.0+1
+  oidc_core: ^0.17.0
+  oidc_loopback_listener: ^0.3.1
   path: ^1.9.1
   pub_updater: ^0.5.0
 
@@ -25,7 +25,7 @@ dev_dependencies:
   build_version: ^2.1.3
   # Used by the device-login integration test to sign the mock id_token + serve
   # a JWKS, so the test exercises the real (fail-closed) verification path.
-  jose_plus: ^0.5.0
+  jose_plus: ^0.6.0
   mocktail: ^1.0.4
   test: ^1.21.0
   very_good_analysis: ^10.0.0