pub.dev · #820 most downloaded on pub.dev

relic_io

1.2.0251K downloads/moserverpod/relic ↗New releases in your daily digest, changelog included.

dart:io adapter for Relic web server.

Last release 7 days ago
30 Sep 2026
Release timing varies
gaps range from 9 days to 4 months
Nearly every release is documented
notes for 6 of 6 stable releases
Nothing withdrawn
no release was ever pulled
8 months old
10 releases · first in 2026

Release timeline

10 releases since 2026

2026

20262026

One column per month.

Releases

2.0.0-rc.230 Sept 2026pre-release
feat!: Add HTML form and multipart parsing (#380) - closes #379
feat!: Add HTML form and multipart parsing (#380) - closes #379

BREAKING: The minimum Dart SDK is 3.10.0. The Dart 3.9.0 compiler crashes in the FFI transform (dart-lang/sdk#61321)

BREAKING: BodyType has no const constructor. Drop const from BodyType(...) calls

BREAKING: Extended Content-Disposition parameters such as filename* are RFC 8187 ext-values and always encode as UTF-8. ContentDispositionParameter has no encoding, and its language is a LanguageTag. Parsing throws FormatException for a charset other than UTF-8 and for a malformed ext-value

Add req.urlEncodedForm(), req.multipartForm() and req.formData(), which picks the parser from the request Content-Type

Add req.multipart() to stream parts without aggregating them. Each part is a MultipartFieldPart, MultipartFilePart or MultipartOtherPart

Read fields through accessors such as IntFormField('age') with form.fields.get, tryGet and getAll, and files through FormFile. A missing field throws MissingFormFieldException, a value that does not decode throws InvalidFormFieldException

FormLimits caps body size, part, field and file counts, and field and file sizes. Going over one throws FormLimitExceededException, whose limit names the FormLimit

Uploads go to MemoryUploadStorage by default. TempUploadStorage in relic_io writes each upload to its own directory. On POSIX systems the directory has mode 0700. On Windows it inherits the permissions of its parent, and the default parent, the user's temp directory, is private to that user. Call MultipartFormData.dispose() to delete them

Upload filenames are reduced to their basename, with control and bidi formatting characters removed. ., .. and an empty filename give a null filename. filename* is ignored, per RFC 7578

The server answers an uncaught FormException with its statusCode, which is 400, 413 or 415. When parsing fails it also sends Connection: close, as the rest of the body may be unread

BodyType carries Content-Type parameters such as boundary in parameters. Body.fromData and Body.fromDataStream take a parameters argument, and the dart:io adapter carries them through

Add a typed ContentTypeHeader, read with headers.contentType. Set Content-Type through the body

From the same repository

serverpod/relic

2.0.0-rc.125 Aug 2026pre-release

refactor!: Drop NormalizedPath interning (#375) - fixes #118, #342, closes #344

refactor!: Drop NormalizedPath interning (#375) - fixes #118, #342, closes #344
- BREAKING: NormalizedPath.interned is removed. Construction no longer caches, so there is no per-isolate cache to size, and no input that can thrash it
- Add Router.lookupUri(method, url), the entry point for request routing: it derives the path with NormalizedPath.fromUri and looks it up with lookupPath
- Routing recovers most of the lost throughput by pre-computing repeated work and by undoing parameter bindings in place while backtracking, instead of copying the parameter map at every level
fix!: Address security audit findings (#369)
- BREAKING: Cross-origin WebSocket upgrades are rejected with 403 by default; pass WebSocketUpgrade(..., allowAnyOrigin: true) to accept them. Only the host is compared, since a TLS-terminating proxy changes scheme and port
- BREAKING: Header names and values are validated on assignment. CR, LF, NUL, and invalid names now throw where every header write funnels, rather than reaching the wire
- BREAKING: Malformed auth headers and non-token MIME type parts are rejected where they were previously tolerated
- The request path is split into segments before percent-decoding, so an encoded separator (%2F) can no longer introduce a path boundary that no upstream proxy saw; NormalizedPath.fromUri names the safe conversion
- The path is normalized before the routing host is prepended, so a path resolving upwards can no longer pop the host and select another virtual host
- Auth headers are parsed with the linear header scanner: one pass with no quadratic backtracking on a long value, and text between auth-params is rejected instead of skipped
- Content-Disposition parameter values and AuthenticationHeader challenge parts are escaped and validated, so a quote in a filename or realm can no longer end the value and graft on another parameter or challenge
- The token grammar is enforced on MIME type parts, which io.ContentType took separately and thus bypassed the CR/LF check applied to ordinary header values
- Multi-range responses are streamed lazily and the range count is capped, so a short request can no longer ask for many times the file size
- Multipart boundaries are drawn from a cryptographic generator instead of ~20 bits from Random
- The adapter dispatch is awaited, so a response that fails to write yields a 500 instead of leaving the connection open and the client waiting
- Detached (hijacked and upgraded) connections are tracked by the adapter: counted by connectionsInfo(), drained and sent a 1001 close on graceful shutdown, and destroyed on close(force: true)
- use() on a catch-all route now applies to the prefix itself, so /api no longer bypasses the middleware that /api/keys runs
- Add Token68 for the RFC 9110 token68 form, used when validating a single-token WWW-Authenticate challenge
- docs: The static file handler never filtered hidden files; the documentation no longer claims it does. Every file in the served directory is served, dot files included

Open source →

2.0.0-beta.024 Jun 2026pre-release

Overhaul of typed HTTP headers for RFC compliance, landing in concert with serverpod 4.0. Parsing of received (request) headers is lenient (except sec

Overhaul of typed HTTP headers for RFC compliance, landing in concert with serverpod 4.0. Parsing of received (request) headers is lenient (except security-sensitive ones), while construction and serialization are always strict. Many typed headers changed shape and/or semantics, so this is a breaking release.

refactor!: Cookie and Set-Cookie headers (#361)
- BREAKING: SetCookie now represents a single cookie, and SetCookieHeader is a List<SetCookie> collection (one Set-Cookie line per cookie, RFC 6265 4.1). The previous single-cookie SetCookieHeader(name:, value:, ...) API is replaced by SetCookie(...); augment a response with mh.setCookie = (mh.setCookie ?? const SetCookieHeader.empty()).add(cookie)
- The request Cookie header is parsed leniently: a malformed cookie is skipped and the header is rejected only when no cookie in it is usable
- Add CookieHeader.getCookies(name) returning every cookie with that name in order; byte-identical duplicates are preserved (not collapsed)
- Set-Cookie decode is strict (it is produced by the server): a malformed attribute rejects the cookie
- Domain is normalized per RFC 6265 5.2.3 — the full leading-dot run is stripped and the host is lower-cased; an all-dots Domain is rejected
- Max-Age is parsed as a strict decimal integer per RFC 6265 5.2.2; non-decimal values such as 0xFF are rejected
- Nameless =value segments are dropped when parsing the request Cookie header
feat!: RFC compliant typed headers (#360) — fixes #113, #142
- Many typed headers changed their Dart interface and/or their parse/serialize semantics
- Parsing is lenient on receive; construction and serialization are strict

Open source →