all_image_cache

Added

• Added deterministic raster, provider, widget, SVG, multi-generation, and multi-source stress regressions for stale decode failures.

Fixed

• Prevented an older raster or SVG decode failure from evicting newer bytes written by putSourceBytes or refresh.
• Kept current corrupted content recoverable through content-aware conditional eviction, so a later request still refetches without an automatic retry loop.

Added

• Added ImageCacheManager.putSourceBytes, an authoritative source-based API for placing uploaded or otherwise already-available image bytes into cache without exposing internal cache-key generation.
• Added deterministic regressions for authoritative writes, decode recovery, byte ownership, storage consistency, network error safety, web compilation, and cleanup performance.

Changed

• Made putBytes authoritative: it now invalidates older generations, in-flight deduplication state, negative-cache entries, and CachedImageProvider identity tokens before storing.
• Cache bytes are copied once on successful insertion and returned through unmodifiable views, avoiding multi-megabyte copies on cache hits while preventing callers from mutating cached content.
• File storage now maps logical keys to SHA-256 .blob filenames. Public cache keys are unchanged, but disk entries written by older versions are treated as cold misses and fetched again.
• Count-only cleanup avoids sorting the full cache when no eviction is needed or only a small number of entries must be removed.
• The legacy ValidationKeyGenerator keeps the same FNV-1a output using web-safe BigInt arithmetic.

Fixed

• Prevented older fetches from overwriting a newer putBytes update.
• Invalidated L1/L2 bytes after actual raster or SVG decode failures so a later rebuild can fetch valid content without an automatic retry loop.
• Rolled back newly written bytes when metadata persistence fails and removed entries whose stored byte length disagrees with metadata.
• Prevented arbitrary logical keys from escaping the configured blob directory or creating nested paths.
• Preserved externally thrown TimeoutException values when no network timeout is configured.
• Removed sensitive paths and query strings from invalid-URL exceptions.
• Restored and validated the example web target with dart2js and the Wasm dry run.

Breaking changes

• NetworkImageSource is no longer const because request headers are now copied into an immutable snapshot at construction. Remove const from NetworkImageSource(...) calls. Code that attempted to mutate source.headers must instead create a new source.
• Native HTTP errors now expose only the URL origin in exception messages and in the attached Uri. Consumers that inspected the full request path or query from these errors must use their own request context instead.

Changed

• Coordinated CachedImageProvider TTL and invalidation with Flutter's decoded ImageCache through bounded, deterministic provider identity tokens.
• Added generation-safe evictSource and refresh; old in-flight work can no longer repopulate or overwrite newer cache state.
• Added optional L1 byte limits, network timeout, and maximum download size.
• Added deterministic concurrency stress and hardening regressions.
• Migrated the example status flow to all_observer with its official lint preset and lifecycle-safe reactive controller.

• Replaced the collision-prone default UUID key algorithm with a local, versioned SHA-256 generator and isolated potentially contaminated legacy cache entries.
• Started raster fades on the first decoded frame and SVG fades after successful parsing, while preserving the placeholder during decode.
• Added source-aware visual keys plus configurable fade-out duration and curve.
• Included manager identity in CachedImageProvider equality and hash code.
• Documented animated imageBuilder compositions and ImageProvider animation limitations.

• Relaxed all_box constraint to accept versions >=0.6.0 <2.0.0.

• Updated all_box to ^0.6.0.

• Added optional positive-cache TTL per request, default TTL, and TTL resolver.
• Documented TTL usage for images that can change while keeping the same URL.
• Fixed README image and language links for pub.dev rendering.

• Updated dependency constraints.

• TODO: Describe initial release.