all_image_cache

Added

• Added a conservative, injectable StaleFallbackPolicy and a redacted ImageNetworkException for transport failures.
• Added idempotent manager/config disposal and safe sequential reinitialization.
• Added versioned physical blob namespaces per all_box container.
• Added staged blob writes with flushed temporary files, recovery backups, rollback after metadata failure, durable transaction markers, and startup invalidation of blob/metadata generations interrupted before commit.
• Added explicit metadata schema versioning and self-healing malformed records.
• Added deterministic state-machine fuzz coverage (seed 12345, 5,000 operations), 100-identity authenticated isolation stress, all_box persistence failure tests, clear-barrier tests, and multi-container regressions.
• Added doc/cache_semantics.md as the formal cache contract.
• Added the explicit 1.x public API stability and exception contract.
• Added ImageCacheManager.l2Stats() to make the reported cache layer unambiguous.
• Added CI gates for the minimum supported Flutter with downgraded dependencies and for the current stable Flutter release.

Changed

• Required metadata commits now await all_box 1.0.0 writeAndSave; LRU touch updates remain debounced and report asynchronous failures through cache events.
• The default stale policy no longer returns expired private bytes after 401/403 and no longer masks compression/storage/programming errors.
• AllImageCache.init() now validates container names by default and disposes the previous manager before reinitialization.
• Moved provider-token and conditional decode-eviction operations to an internal extension excluded from the public barrel, and marked singleton overrides as testing-only.
• Deprecated ambiguous ImageCacheManager.stats() in favor of l2Stats(); the alias remains available throughout 1.x.
• Lowered the package floor to Dart 3.3.0 / Flutter 3.19.0 and widened direct dependency compatibility to the oldest APIs exercised by the package. The example development tooling declares its separate Dart 3.10.0 / Flutter 3.38.0 requirement.
• Tightened the test-only platform lower bound to 3.1.0 so minimum-dependency validation cannot select the incompatible 3.0.0 release.

Added

• Added deterministic raster, provider, widget, SVG, multi-generation, and multi-source stress regressions for stale decode failures.

Fixed

• Prevented an older raster or SVG decode failure from evicting newer bytes written by putSourceBytes or refresh.
• Kept current corrupted content recoverable through content-aware conditional eviction, so a later request still refetches without an automatic retry loop.

Added

• Added ImageCacheManager.putSourceBytes, an authoritative source-based API for placing uploaded or otherwise already-available image bytes into cache without exposing internal cache-key generation.
• Added deterministic regressions for authoritative writes, decode recovery, byte ownership, storage consistency, network error safety, web compilation, and cleanup performance.

Changed

• Made putBytes authoritative: it now invalidates older generations, in-flight deduplication state, negative-cache entries, and CachedImageProvider identity tokens before storing.
• Cache bytes are copied once on successful insertion and returned through unmodifiable views, avoiding multi-megabyte copies on cache hits while preventing callers from mutating cached content.
• File storage now maps logical keys to SHA-256 .blob filenames. Public cache keys are unchanged, but disk entries written by older versions are treated as cold misses and fetched again.
• Count-only cleanup avoids sorting the full cache when no eviction is needed or only a small number of entries must be removed.
• The legacy ValidationKeyGenerator keeps the same FNV-1a output using web-safe BigInt arithmetic.

Fixed

• Prevented older fetches from overwriting a newer putBytes update.
• Invalidated L1/L2 bytes after actual raster or SVG decode failures so a later rebuild can fetch valid content without an automatic retry loop.
• Rolled back newly written bytes when metadata persistence fails and removed entries whose stored byte length disagrees with metadata.
• Prevented arbitrary logical keys from escaping the configured blob directory or creating nested paths.
• Preserved externally thrown TimeoutException values when no network timeout is configured.
• Removed sensitive paths and query strings from invalid-URL exceptions.
• Restored and validated the example web target with dart2js and the Wasm dry run.

Breaking changes

• NetworkImageSource is no longer const because request headers are now copied into an immutable snapshot at construction. Remove const from NetworkImageSource(...) calls. Code that attempted to mutate source.headers must instead create a new source.
• Native HTTP errors now expose only the URL origin in exception messages and in the attached Uri. Consumers that inspected the full request path or query from these errors must use their own request context instead.

Changed

• Coordinated CachedImageProvider TTL and invalidation with Flutter's decoded ImageCache through bounded, deterministic provider identity tokens.
• Added generation-safe evictSource and refresh; old in-flight work can no longer repopulate or overwrite newer cache state.
• Added optional L1 byte limits, network timeout, and maximum download size.
• Added deterministic concurrency stress and hardening regressions.
• Migrated the example status flow to all_observer with its official lint preset and lifecycle-safe reactive controller.

• Replaced the collision-prone default UUID key algorithm with a local, versioned SHA-256 generator and isolated potentially contaminated legacy cache entries.
• Started raster fades on the first decoded frame and SVG fades after successful parsing, while preserving the placeholder during decode.
• Added source-aware visual keys plus configurable fade-out duration and curve.
• Included manager identity in CachedImageProvider equality and hash code.
• Documented animated imageBuilder compositions and ImageProvider animation limitations.

• Relaxed all_box constraint to accept versions >=0.6.0 <2.0.0.

• Updated all_box to ^0.6.0.

• Added optional positive-cache TTL per request, default TTL, and TTL resolver.
• Documented TTL usage for images that can change while keeping the same URL.
• Fixed README image and language links for pub.dev rendering.

• Updated dependency constraints.

• TODO: Describe initial release.