atproto_core

Releases

1. ▸▾2.4.18 Aug 2026

   chore: bump atproto_oauth to ^0.8.0.

   • chore: bump atproto_oauth to ^0.8.0.

   Open source →
2. ▸▾2.4.026 Jul 2026

   fix: decodeCar validates the CAR header length instead of trusting it. A truncated archive whose header varint claimed more bytes than exist pushed th

   • fix: decodeCar validates the CAR header length instead of trusting it. A truncated archive whose header varint claimed more bytes than exist pushed the cursor past the end and decoded to an EMPTY map — a truncated repository export looked like an empty repository, silently losing every block. It now throws CarException, the same contract the block-length check already honored.
   • fix: a varint whose payload reaches the 64th bit no longer wraps to a negative length and escapes as a raw RangeError from deep inside the decoder; it is rejected as a CarException in the varint reader itself, so every caller of it is covered. Length checks are also written as subtractions so a near-maximum length cannot overflow the cursor past its own bounds check.
   • feat: added ServiceContext.withAdditionalHeaders, which derives a context from this one's headers plus the given ones instead of replacing them. withHeaders replaces, so every caller adding a single header spread the origin's headers back in by hand — and a spread is key-exact, which leaves a caller's Atproto-Proxy sitting next to the added atproto-proxy. Header names are case-insensitive, so this merges case-insensitively and the added header wins.
   • fix: ServiceContext.headers no longer hands out the context's live internal map. Any holder could write to it, and because a context derived via withHeaders and the clients built on it read the same field, one headers['atproto-proxy'] = ... retargeted every request every one of them made — while headers.remove(...) silently dropped a header a client needs for the rest of its life. The map is now copied at construction and exposed unmodifiable, consistently: previously the same write threw UnsupportedError when no headers had been supplied and succeeded when they had.
   • fix: a 5xx now reaches a custom RetryStrategy with its true status code. checkStatus funnels 500, 502, 503 and 504 into a single InternalServerErrorException, and the retry layer hardcoded statusCode: 500 when building the RetryContext, so a strategy branching on context.statusCode == 503 could never match.
   • fix: a Retry-After / ratelimit-reset sent with a server error is now honored. It was read only on the 429 path, so the wait a 503 asked for was silently dropped.
   • fix: a 401 provoked by an access token the session has already rotated past no longer triggers a further refresh. Single-flighting only coalesces requests that overlap an in-progress refresh; a request already on the wire with the superseded token 401s after the rotation lands, and each such response used to chain another rotation — spending an unused refresh token and emitting an onSessionUpdated the owner has to persist. The token the failed request actually carried is now compared against the current session, and a stale one is simply retried.
   • fix: the exponential backoff in RetryConfig is now capped at 60 seconds, matching the "capped exponential backoff" it documents. Uncapped, 2 ^ (attempt - 1) reaches roughly six days by attempt 20.
   • fix: a server-requested wait can no longer shorten a retry. The 60-second clamp was applied after the comparison, so a server asking for 1000s while the backoff stood at 512s collapsed the wait to 60s — a larger requested delay produced a shorter wait than plain backoff.
   • fix: a user-supplied onRefreshSession is now bounded by the context's timeout. It is awaited at the head of every request behind a single flight, so one that never completed stalled every request on the context forever; timeout previously covered only the xrpc call.
   • fix: Challenge.execute no longer exposes its recursion state (attempt, dpopNonceRetryCount, sessionRefreshed) on the public signature, where a caller passing e.g. attempt: 5 corrupted the retry accounting. Challenge is publicly exported; the loop state moved to a private _execute.
   • docs: RetryConfig documented its jitter as 0 ~ 3 while the implementation drew 0 ~ 4 inclusive.

• blueskypub.devThe most famous and powerful Dart/Flutter library for Bluesky Social.
• atprotopub.devThe most famous and powerful Dart/Flutter library for AT Protocol.
• multiformatspub.devCore library for parsing IPFS-related things. This package is mainly used by https://atprotodart.com packages.
• xrpcpub.devCore library for XRPC communication. This is a wrapped HTTP client for AT Protocol.
• bluesky_textpub.devProvides the easiest and most powerful way to analyze the text for Bluesky Social.