betto_zstd

• Bump the version to 0.1.0 and open its CHANGELOG section
• Restore code_assets to ^1.2.0 (unintentionally relaxed to ^1.1.0 in
  d6c67a7 and shipped that way in 0.1.0-dev.4)
• Document in the README that iOS and Android are validated locally only and
  are not yet covered by automated CI — the one caveat the 0.1.0-dev.1
  release review placed on a public pub.dev publish

Co-Authored-By: Claude Opus 5 [email protected]

First stable release. No functional changes to the compression API since 0.1.0-dev.4.

• Restored the code_assets constraint to ^1.2.0; it had been relaxed to ^1.1.0 unintentionally and shipped that way in 0.1.0-dev.4.
• README now states that iOS and Android are validated locally only and are not yet covered by automated CI.

• Moved to Dart SDK 3.13
• Security: bounded decompress's allocation against an attacker-controlled declared frame size (KMDB finding S-2). decompress now takes an optional maxOutputBytes parameter (default defaultMaxOutputBytes, 64 MiB) and throws the new ZstdLimitExceededException — before allocating anything for the declared size — when a frame's declared decompressed size is negative or exceeds the limit. There is no unbounded/opt-out mode; callers that need to decompress something larger pass a larger explicit value. bin/dartz.dart passes an explicit 1 << 40 cap, since a locally-selected file is trusted input.
• Fixed a native allocation-ordering leak in compress: a failure allocating the destination buffer could previously leak the already-allocated source buffer (KMDB finding F-1). Each allocation is now guarded by its own nested try/finally, matching the structure already used on web.
• The web _malloc helper now throws ZstdException when the underlying WASM malloc returns a null pointer (0), instead of silently proceeding to write at heap offset 0 on allocation failure.

Further publishing fixes

Minor fix to .pubignore as publishing needed the third_party/ dir

• Fix .pubignore incorrectly excluding lib/src/ from the published package.
• Declare platform support for Android, iOS, Linux, macOS, Windows, and Web.
• Update hooks to ^2.0.0, native_toolchain_c to ^0.19.0, code_assets
  to ^1.2.0.
• Suppress ffigen-generated file warnings from pub.dev static analysis.

Fixes to repair poor pub.dev score:

• Fix .pubignore incorrectly excluding lib/src/ from the published package.
• Declare platform support for Android, iOS, Linux, macOS, Windows, and Web.
• Update hooks to ^2.0.0, native_toolchain_c to ^0.19.0, code_assets to ^1.2.0.
• Suppress ffigen-generated file warnings from pub.dev static analysis.

• Initial version.