zikzak_inappwebview_macos

Features

• [macOS] InAppWebViewSettings.contentBlockers is now actually applied. The setting was declared and decoded on macOS but never consumed — no WKContentRuleList was ever compiled or added, so ad/tracker blocking was silently inert while the identical setting works on iOS. setSettings now removes all content rule lists, serializes the decoded blockers, compiles them through WKContentRuleListStore under the shared ContentBlockingRules identifier, and adds the result to configuration.userContentController; an empty list clears blocking without compiling. Compilations are serialized with a token so a stale completion can no longer re-add rules a newer update removed, and a single applyContentBlockers funnel serves platform views, InAppBrowser, headless webviews and runtime updates (#338)
• [macOS] useOnDownloadStart / onDownloadStartRequest are now wired. macOS declared the setting and accepted the Dart callback, but no Swift code read the flag and no WKDownload plumbing existed, so the documented support could never fire. The package now adopts WKDownloadDelegate, returns .download from the navigation-response policy when the MIME type cannot be shown (with an iOS-style main-frame/non-text-mime fallback that dispatches the event and cancels), dispatches the event and cancels the native download from the destination callback so Dart streams the bytes, maps Dart policy DOWNLOAD to .download in shouldOverrideUrlLoading, bridges through WebViewChannelDelegate, and routes the event in the Dart controller. The action-stage handoff now reports a real contentLength and derives suggestedFilename from the URL path (#339, #340, #344)
• [macOS] InAppBrowser forwards onDownloadStartRequest to its event handler — downloads started in the browser never surfaced an event before (#344)
• [iOS/macOS] The platform-view root is now pinned to its Flutter bounds. On iOS clipsToBounds is set unconditionally at view setup; on macOS layer.masksToBounds = true is pinned at construction time (after wantsLayer, so the pin cannot be a silent no-op) and re-asserted after the web view is embedded. An NSView does not clip by default, so a native layer could paint over sibling Flutter content on a mis-clipped compositing path (#331, #336, #337)

Bug Fixes

• [iOS] Forward private custom URL schemes to shouldOverrideUrlLoading. Payment and authentication deep links such as weixin:// were cancelled by the native pre-navigation gate before the host navigation delegate ran, so a host could not intercept them and open the URL externally. The gate now blocks only what URLValidationManager already treats as dangerous (blocked schemes, failing scheme-specific checks, schemeless URLs, a rejecting custom validator); a custom scheme that no host policy handles is still cancelled
• [macOS] Stop an EXC_BREAKPOINT crash on macOS 15.x. WKNavigationAction.sourceFrame is declared non-optional by the Swift overlay, but WebKit can deliver a nil runtime object, and member access then traps in the unconditional Objective-C bridge. Navigation source frame and request/security origin are now read through a KVC-based accessor that yields nil for a nil runtime frame, at both the shouldOverrideUrlLoading and onCreateWindow call sites. With a present frame the emitted map is unchanged; with a nil frame Dart receives sourceFrame: null, which NavigationAction/CreateWindowAction already model as nullable (#327)
• [Dart] onDownloadStartRequest tolerates a null arguments map and drops a URL-less payload instead of throwing out of DownloadStartRequest.fromJson (#344)
• [iOS] The pre-navigation gate and URLValidationManager no longer evaluate a custom scheme twice — one scheme policy returns an explicit block / defer-to-host / allow decision that is reused as the delegate fallback, so a host custom validator runs once per navigation. The fallback stays fail-closed

Internal

• Every macOS parity gap above is guarded by source-contract and behavioral tests runnable on any host (content_blockers_parity_test, content_blockers_rule_list_test, download_start_request_parity_test, swift_sourceframe_kvc_test, swift_platform_view_clipping_test, ios_custom_scheme_navigation_test)
• InAppWebView/WebViewChannelDelegate param-listener tests hardened: handleMethod now proves a decoded download event reaches the params callback and that a malformed one is dropped
• Bug and feature records for #327, #331, #337, #338, #339 and the iOS custom-scheme navigation fix live under .specify/bugs/, with TDD cycle logs and verification reports

Docs

• Record the macOS WKWebView passkey requirements (web credentials entitlement, apple-app-site-association host, document-focus gotcha) in INSIGHTS.md
• Upstream engine report for the Flutter 3.47.x platform-view overlay compositing artifact filed as flutter/flutter#193363, with an on-device mitigation matrix and evidence frames under .specify/bugs/flutter347-platformview-rendering/

Example

• Add a WebAuthn passkey test page plus a local relying-party host, wired into the macOS example drawer, for manual passkey validation

fix: revert zuraffa_session to ^1.1.0 (6.3.0 not on pub.dev)

Bug Fixes

• [iOS] Make InAppWebView.evaluateJavaScript(_:completionHandler:) portable across Xcode versions. Its completion handler was declared @MainActor @Sendable (Any?, (any Error)?) -> Void, which only matches the SDK bundled with recent Xcode. On older SDKs the method stopped overriding its superclass and the extra overload it left behind made every single-argument evaluateJavaScript(...) call ambiguous — 10 compile errors, meaning consumers on older Xcode could not build the iOS plugin at all
• [Web] consoleLogEnabled: false now actually disables console interception. The guard read params.webviewParams?.settings, a field that does not exist on PlatformWebViewCreationParams — it is initialSettings — so the web implementation did not compile either
• [iOS] Declare dataStoreWasSelected in the scope shared by the iOS 9 and iOS 11 availability blocks in preWKWebViewConfiguration; it was declared inside the iOS 9 block but read by the later cookie-setup block, so the file did not compile (#316, #329)
• [iOS] Remove two always-true != null guards in HttpAuthCredentialsDatabase and an unused dart:typed_data import in its screenshot/PDF delegation test

Internal

• CI passes end to end again, now 15 jobs. flutter analyze runs with --no-fatal-infos: compile errors and warnings fail the build, style-level infos do not
• zikzak_inappwebview_ios joined the analyze and test matrices, and a build-ios job compiles its Swift sources from this checkout — that job is what surfaced the evaluateJavaScript breakage above
• Fixed constant_identifier_names in zikzak_inappwebview_platform_interface/analysis_options.yaml — linter: rules: accepts only booleans, so ignore left the rule enabled and produced 558 findings
• Intra-repo dependencies resolve from local source through dependency_overrides, so CI exercises this checkout rather than the published artifacts

6.0.0

Breaking Changes

• Session layer renamed: zikzak_session → zuraffa_session (^1.1.0). WebViewSessions and the portable-session APIs now consume zuraffa_session types — consumers passing zikzak_session session stores must migrate their imports or stay on 5.x.

Features

• Aligned with the Zuraffa fleet package identity (zuraffa_session).

Bug Fixes

• [iOS] Fix #available usage and minimum platform version mismatch — resolves iOS build failures (#316, #319)
• [macOS] Implement UserScript initializer init(source:injectionTime:forMainFrameOnly:in:) for iOS parity (#317, #318)

Bug Fixes

• [macOS] Sanitize non-cloneable objects (DOMException, Error, RegExp, Promise, etc.) in console bridge JS before postMessage — prevents WebKit SIGSEGV on multi-tab same-profile navigation (#309, #312)
• [macOS] Restore userContentController public access to satisfy WKScriptMessageHandler protocol conformance (#314)

Features

• Add consoleLogEnabled setting (default true) — when false, the console override script is not injected and console.log/error/warn messages are NOT forwarded to Dart. Wired on all 4 platforms that intercept console: macOS, iOS, Android, Web

Bug Fixes

• [Windows] Add missing kDebugMode import — fixes build error in 5.3.1 (#315)

Bug Fixes

• [macOS] Restore public access on userContentController(_:didReceive:) to satisfy WKScriptMessageHandler protocol conformance — fixes build breakage in 5.3.0 (#312, #313)

Features

• [Windows] WebView2 environment reuse is now observable and regression-tested (#300, #303)
• [Windows] Enforce callback ordering and dispose safety for load events (#301, #304)

Bug Fixes

• [macOS] Defensive deserialization of WKScriptMessage.body — prevents SIGSEGV crash when JS posts DOMException or other non-cloneable objects through the zikzak bridge (#309)
• [macOS] Add ObjC exception boundary (ZikzakExceptionCatcher) to catch WebKit deserialization exceptions in WeakScriptMessageHandler
• [macOS] Recursively sanitize message bodies for Flutter standard message codec — non-cloneable leaves converted to string representation

Features

• [macOS] Per-profile proxy support via WKWebsiteDataStore.proxyConfigurations
• [macOS] ProxyController implementation using WKWebsiteDataStore.proxyConfigurations
• [Android] Honor PDFConfiguration page size/margins/orientation in createPdf
• HeadlessInAppWebView double-dispose guard for safe reuse
• Network capture: per-domain maxBodySize, maxBytes, maxEntries budget enforcement
• Network capture: redact auth-shaped secrets at source (URL/body params)
• Portable sessions (014), dismiss dialogues (002), dispose patterns (013)
• Platform interface: expose and export four domain controller delegates (navigation, javaScript, cookie, settings)
• Wave Z module scaffold — split map, ports, WebViewPool, VCR, grep gate
• [iOS/macOS] Per-instance persistent isolated WKWebsiteDataStore via persistentStoreIdentifier
• GYM real exercises for zikzak_inappwebview (warmup + js-bridge-round-trip)

Fixes

• Remove duplicate delegate declarations and imports in android/iOS controllers
• [macOS] Use registrar.messenger property, not method call
• Controller forward urlResponse to navigation facade
• WebView sessions reject mismatched-origin sessions and clear prior state on load
• [Android] takeScreenshot reads laid-out size and defers capture until layout
• Platform add WebContent readiness gate, emit enum wire names
• Umbrella pin zuraffa to working hosted 6.0.1
• [Android] lower minSdkVersion to API 24 (closes #276)
• [iOS/Android] Bulletproof the WebAuthn/passkey wiring
• [macOS] Restore headless run() Dart test + make run() re-runnable after dispose
• [iOS] Route cookie ops through the webview's own data store
• [macOS] Enable WebAuthn/passkey sign-in by wiring webAuthenticationSupport into WKWebViewConfiguration
• [macOS] Dispatch onScrollChanged/onContentSizeChanged/onOverScrolled to callbacks
• [Linux] Platform gap analysis and hardening - API coverage, CookieManager, error reporting
• Address CodeRabbit review comments and auto-fixes

Refactors

• Extract legacy dismissDialogues into testable seam

Tests

• [iOS] dismissDialogues integration tests (A1-A6)
• [macOS] takeScreenshot PNG, JPEG, rect crop acceptance tests (mutant-verified)
• [Android] takeScreenshot rect crop acceptance test (mutant-verified)
• [iOS] takeScreenshot PNG and createPdf acceptance tests
• Dispose contract and keepAlive semantics tests across all controllers
• Platform delegate behavioral tests for navigation, settings, JS, and cookie controllers
• Full-feature conformance suite for Zorphy migration (Phase 4)

Docs

• TDD audit and spec review comments addressed
• TDD cycle logs and verification records for specs 001, 010-014
• JS bridge rename documentation extended into API docstring and example assets

Chores

• Exclude generated platform dirs from analyzer
• Add TDD stack profile for lifecycle/sessions verification
• Add generated coverage/lcov.info for platform_interface
• Add spec-kit TDD/bug/git extensions and .kimi-code skills
• Restore development path dependencies after 5.1.2 publish

docs: improve 5.1.2 changelog with pressKey fix details

feat: persistent per-account website data store via persistentStoreId…

fix(macos): thread webViewId through cookie manager and headless/webv…

Fixes

• Fixed Android ClassCastException failures when enum settings were serialized as string names instead of their expected integer wire values. Added the missing enum wire converters and corrected affected platform-interface JSON mappings.

Breaking Changes

• Migrated the entire platform_interface model layer to Zorphy entities — every model class is now a Zorphy entity instead of a hand-written @ExchangeableObject-style class (Phases 1–3j). This changes the public API surface of the platform interface (class structure, toJson/fromJson, equality) and may require updates to custom platform implementations.

Features

• [platform_interface] Migrated model families to Zorphy entities: JS dialogue, ajax request, fetch request, console message, web resource, permission/safe-browsing, navigation, auth/ssl, pull-to-refresh, web storage, web message, web authentication session, context menu, webview environment, chrome safari browser, print job, InAppBrowserMenuItem, tracing settings, user script, image/rect/screenshot config, in-app webview settings, and script HTML tag attributes

Chores

• Removed the dead @ExchangeableObject codegen toolchain
• Removed the Docusaurus website (to be replaced by a zread wiki)

fix(publish): convert example pubspec sibling deps to versioned for 4…

Features

• Session recipe — record and replay user sessions in the WebView: JS
  tap-listener injection, selector-candidate extraction, scripted click replay,
  and recipe models (#216)
• Navigation tracker — JS-assisted URL-cycle tracking through the webview (#216)
• Dialogue dismisser — inject JS to auto-dismiss modal dialogs (#216)
• Navigation guards — keepNavigationInWebView helper that keeps user-tapped
  links inside the WebView, avoiding iOS universal-link handoff (#216)
• [Windows] Virtual host name to folder mapping — CORS-safe serving of local
  folders (CORS bypass for local resources) (#185)
• [macOS] Popup windows — window.open / target=_blank now load their URL
  via WKUIDelegate createWebViewWith off-screen-window support, reparented
  into a Flutter platform view when onCreateWindow is handled (#182, #183, #187)

Fixes

• [macOS] Popup window crash, settings key, and event delivery fixes (#187)
• [macOS] Network Capture API callbacks never fired — JS bridge name aligned
  with iOS/Android so onNetworkRequest / onNetworkResponse /
  onNetworkLoadingFinished reach Dart (#182)
• [Linux] Blue screen instead of webview — offscreen rendering via
  GtkOffscreenWindow + software rendering, plus openDevTools support (#184)
• [Linux] Native plugin compile regression — broken takeScreenshot string
  literal and missing include path (#179)
• Chore: renamed remaining flutter_inappwebview residuals to
  zikzak_inappwebview (JS bridge name, method channel, platform view type id) (#186)
• Chore: dependency bumps (npm deps, brace-expansion) (#189, #210)

Features

• [macOS] Add context-menu support — disableContextMenu / disableLongPressContextMenuOnLinks settings now honored, onCreateContextMenu event fired (#208, fixes #196)
• [macOS] Implement WKNavigationDelegate authentication challenges — HTTP basic/digest/NTLM/Negotiate, TLS server-trust, and client-certificate requests (#207, fixes #193)
• [macOS] Method-channel parity — ~50 controller methods implemented on iOS are now available on macOS (MissingPluginException resolved) (#205, fixes #197)
• [macOS] Implement print page support reusing the iOS pattern (#190, fixes #188)
• [Android] Add window-insets control for web content (setInsetsForWebContentToIgnore equivalent) (#206, fixes #198)
• [iOS] Add UIScrollView bouncesHorizontally / bouncesVertically (iOS 17.4+) (#209, fixes #199)
• [Android] Bump toolchain — androidx.webkit 1.15.0, AGP 8.13.1, JVM target 17 (#211, fixes #201)
• Refactor: split InAppWebViewController into domain-specific controllers (#176)
• Refactor: standardize dispose patterns across all wrapper classes (#175)

Fixes

• [macOS] Implement media-capture permission prompts for getUserMedia() — no longer silently denied (#204, fixes #195)
• [macOS] Implement webViewWebContentProcessDidTerminate — no more blank/unrecoverable WebView after content-process kill (#203, fixes #194)
• [macOS] Await shouldOverrideUrlLoading response so cancellations are honored (#202, fixes #192)
• [macOS] Use WKWebpagePreferences.allowsContentJavaScript instead of deprecated WKPreferences.javaScriptEnabled (#212, fixes #200)
• [macOS] Replace deprecated javaScriptEnabled read in getSelectedText (#213)
• [macOS] Repair SPM build — duplicate Util.swift, iOS-only APIs, init ordering (#215)
• [macOS] Add missing onPageCommitVisible / onDidReceiveServerRedirectForProvisionalNavigation method-channel handlers (#217)
• [Windows] Forward additionalBrowserArguments to WebView2 (#214, fixes #178)
• [Windows] Implement addJavaScriptHandler + JS bridge (fixes #177)
• [Android] Use androidx.core.view.OnApplyWindowInsetsListener type directly (#217)

Features

• Added iOS proxy support (iOS 17.0+) — set process-wide proxy for WKWebView
• Added Network Capture API — capture XHR/fetch requests and response bodies
• Added Network Capture Scraper example screen

Fixes

• Fixed: Web/WASM build failure — HeadlessInAppWebViewWeb.dispose() missing
  isKeepAlive parameter that was added to PlatformHeadlessInAppWebView.dispose
  interface, causing dart2wasm and dart2js compile errors
• Fixed iOS: removed duplicate else clause in ProxyManager guard statement
• Fixed iOS: added missing Flutter import and fixed Swift API usage in ProxyManager
• Fixed Linux: removed unused <iostream> includes and call load_initial in
  createHeadless
• Fixed Linux: fixed pre-existing C++ issues in in_app_webview.cc
• Fixed: restored Disposable interface on PlatformProxyController

Chores

• Removed network capture example from public package
• Added .clangd and compile_flags.txt for Linux Flutter header resolution
• Bumped svgo dependency

• Fixed: Web/WASM build failure — HeadlessInAppWebViewWeb.dispose() missing
  isKeepAlive parameter that was added to PlatformHeadlessInAppWebView.dispose
  interface, causing dart2wasm and dart2js compile errors

• Fixed: Web/WASM compilation broken by unconditional dart:io import in platform
  interface — replaced with conditional export if (dart.library.io) to compile
  a stub on Web/WASM and the real HttpServer-based implementation on native

• Fixed: iOS InAppBrowser crash after SPM migration — storyboard now loaded via Bundle.module instead of main bundle, resolving "Could not find a storyboard named 'WebView'" exception when opening the in-app browser
• Fixed: Android WebView lifecycle — onFlutterViewDetached() now properly destroys the WebView (guarded against keepAlive)
• Fixed: Android WebSettings OEM crash protection — 18 WebSettingsCompat.* calls wrapped in try/catch for Huawei/Honor/OnePlus devices
• Fixed: iOS webViewWebContentProcessDidTerminate now auto-reloads after 500ms with isDisposed guard
• Fixed: iOS URLValidationManager wired into navigation flow — blocks javascript:, vbscript:, jar, wyciwyg schemes at native level
• Fixed: InAppLocalhostServer race condition — added Completer gate to prevent SocketException: Address already in use on rapid start/close
• Fixed: PullToRefreshController — added _isDisposed guard with MissingPluginException catch
• Fixed: Headless WebView cleanup — explicit stopLoading() and script removal in deinit/dispose across iOS, Android, and Dart layers
• Fixed: webkit2gtk-4.0 compile failure with proper memory cleanup
• Feature: Web platform — added addJavaScriptHandler/removeJavaScriptHandler/ hasJavaScriptHandler via postMessage bridge
• Feature: Windows — wired WebViewEnvironmentSettings.userDataFolder into WebView2 initialization with writability verification
• Security: iOS native URL scheme validation via URLValidationManager
• Perf: CookieManager — all 7 methods wrapped with Lock.synchronized() for thread-safe concurrent access

• Fixed: iOS InAppBrowser crash after SPM migration — storyboard now loaded via Bundle.module instead of main bundle, resolving "Could not find a storyboard named 'WebView'" exception when opening the in-app browser
• Cleaned up any version constraints from dev/example pubspec files

• Fixed: Generator no longer produces InvalidType for fields referencing other generated types (e.g. PrintJobColorMode?) — the exchangeable_object_generator now falls back to AST source text when the analyzer can't resolve a type
• Feature: Added camelCase convenience getters for all SCREAMING_SNAKE_CASE enum constants (e.g. UserScriptInjectionTime.atDocumentStart, Sandbox.allowPopups, ConsoleMessageLevel.warning)
• Fixed: exchangeable_enum_generator no longer attempts to generate getters for Dart reserved words (default, switch, etc.) or @ExchangeableEnumCustomValue fields with non-standard types
• Docs: Added GENERATOR_NOTES.md documenting the console_message.g.dart null-safety hand-edit and regeneration workflow

• Fixed: macOS addJavaScriptHandler bridge now uses postMessage with a JSON string instead of structured clone — eliminates EXC_BAD_ACCESS crash in WebCore's wrap<DOMException> when passing large or complex data through callHandler
• Fixed: macOS evaluateJavascript now returns null to Dart instead of throwing PlatformException when WKWebView returns nil (e.g., for undefined, void, or Promise expressions)
• Fixed: macOS initialUserScripts parameter was silently ignored — WKWebView now properly injects user scripts during initialization
• Added: UserScriptInjectionTime.atDocumentStart and atDocumentEnd convenience getters (in addition to existing AT_DOCUMENT_START / AT_DOCUMENT_END)
• Removed: CocoaPods podspec files from iOS and macOS packages (project is now 100% SPM)

• Feature: Added addJavaScriptHandler / removeJavaScriptHandler / hasJavaScriptHandler support on macOS — the JavaScript bridge (window.flutter_inappwebview.callHandler()) is now fully functional, enabling bidirectional communication between Dart and JavaScript in macOS WKWebView
• Fixed: macOS ConsoleMessage.fromMap crash when receiving null message or messageLevel values from JavaScript — fixed at the Swift native layer (coerces null to empty string), Dart macOS controller (null-safe constructor) and shared ConsoleMessage.fromMap (null-safe defaults for all platforms)
• Tests: Added unit tests for macOS controller (addJavaScriptHandler lifecycle) and platform interface (ConsoleMessage.fromMap null safety)

• Fixed: macOS InAppWebView no longer returns WKWebView directly as the platform view — it now wraps it in a container NSView with proper autoresizing masks, eliminating the blank screen caused by a zero-frame WKWebView that couldn't resize to fill its allocated space
• Fixed: macOS example app entitlements — added missing com.apple.security.network.client to both DebugProfile and Release entitlements, granting WKWebView's networking process outgoing access so it can load remote web pages under App Sandbox
• Updated: Flutter SDK upgrade with project configuration migration across all platforms (Android build.gradle → build.gradle.kts, iOS SceneDelegate, Xcode project updates, platform file regeneration)

• Fixed: macOS headless WebView now uses a dedicated off-screen NSWindow instead of attaching to the main window with alphaValue = 0.01 — eliminates potential mouse event interception behind the Flutter surface while still providing the view hierarchy WKWebView needs for rendering and JS execution

• Fixed: iOS JavaScript handler error messages with newlines, backslashes, or carriage returns are now properly escaped via JSONSerialization instead of single-quote interpolation that produced SyntaxError: Unexpected EOF and left JS promises pending forever — matches Android's JSONObject.quote()

• Fixed: Windows and Linux onWebViewCreated type mismatch — platform controllers (InAppWebViewWindowsController, LinuxInAppWebViewController) are now wrapped through controllerFromPlatform to return proper InAppWebViewController instances

• Fixed: Android build failure — URLRequest constructor calls in InAppWebViewClient, InAppWebViewClientCompat, and InAppWebViewChromeClient now pass the 5th timeoutInterval parameter to match the updated constructor signature

• Feature: Android URLRequest now supports timeoutInterval — the InAppWebView will stop loading after the specified interval, making rendered HTML available for extraction via getHtml() even if the page hasn't fully loaded
• Feature: macOS URLRequest native extension with full property support — init(fromPluginMap:) and toMap() covering method, body, headers, cache policy, network service type, timeout interval, and more
• Refactor: macOS InAppWebView uses the new URLRequest(fromPluginMap:) extension for cleaner URL loading in both initial load and loadUrl()
• Chore: prepare_for_publish.sh no longer attempts to update CocoaPods podspecs (migrated to Swift Package Manager)
• Chore: Updated dependency lock files

• fixed macos setting and removed pods from example
• 'updated deps'

• Remove debugPrint dealloc statements from Swift deinit blocks
• published

• Merge pull request #147 from arrrrny/fix/issue144-stuck-loading
• fixed timer issue
• bumped gradle
• fix(android): resume global WebView timers when preparing a new InAppWebView
• chore(android): bump Gradle wrapper to 9.1.1 for AGP 9.0
• chore(android): upgrade AGP to 9.0.0
• chore(android): add .kotlin/ to gitignore
• chore: remove accidentally committed .kotlin session file
• fix(android): upgrade Gradle/AGP/Kotlin and migrate off kotlin-android
• Merge branch 'publish-4.3.5'
• 'pub get
• Merge pull request #146 from arrrrny/fix/v4.3.5-build-fixes

• Fixed: macOS build failure — removed stray } that closed the InAppWebView class prematurely, leaving WKNavigationDelegate/WKUIDelegate methods outside the class scope. Also removed dead result variable reference from shouldOverrideUrlLoading (#145)
• Fixed: Android AGP 9+ build failure — replaced getDefaultProguardFile('proguard-android.txt') with getDefaultProguardFile('proguard-android-optimize.txt') in android/build.gradle (#143)
• Fixed: Linux build failure with WebKitGTK 2.52+ — migrated deprecated webkit_web_view_run_javascript → webkit_web_view_evaluate_javascript and replaced removed synchronous webkit_web_view_get_snapshot with async version (#142)
• Fixed: Windows build failure — removed pluginClass from pubspec.yaml; the Windows plugin is Dart-only (uses webview_windows package), so no native CMake project is needed (#142)
• Fixed: CMake include directory visibility for Linux plugin — changed INTERFACE to PUBLIC so the plugin can find its own headers (#142)

• Fixed: iOS type 'int' is not a subtype of type 'WebAuthenticationSupport?' crash in getHtml()/getSettings() — InAppWebViewSettings.fromMap() now converts webAuthenticationSupport via WebAuthenticationSupport.fromNativeValue() instead of assigning the raw int value from the platform channel map

• fix: use KVC for webAuthenticationSupport to avoid SDK availability issue

• Fixed: iOS Passkey/WebAuthn support — wired webAuthenticationSupport setting into native WKWebViewWebAuthenticationSupport.boundKeychainForPasskeys on iOS 16.4+ (#131)
• Fixed: macOS 26 crash in AppKit NSToolbar when InAppBrowser window closes — added isClosing guard and window?.delegate = nil before teardown (#87)
• Fixed: macOS WebView native frame drift with fractional platform view widths — overrode layout() to explicitly sync frame from superview bounds (#93)
• Fixed: iOS shouldOverrideUrlLoading deadlock when adding custom headers — added isNavigatingWithCustomAction flag to prevent re-entrant navigation callbacks (#132)
• Fixed: InAppLocalhostServer fails after app resumes from background — added AppLifecycleListener to close and reset server state on resume (#113)
• Fixed: build_runner fails due to missing generators package — added as dev_dependency in platform_interface pubspec (#139)
• Feature: WebAuthenticationSession now supports additionalHeaderFields for custom HTTP headers — available on iOS 17.4+ (#100)
• Chore: Raised minimum Flutter version from 3.29.0 to 3.38.6 for iOS touch fix (#128)

• Fixed: iOS onCreateWindow not respecting client return value — now returns nil when the client handles the window creation, preventing WebKit from creating an unused window WebView (#107)
• Fixed: iOS crash on InAppWebView.dispose() when KVO observers fire after disposal — added isDisposed guard to observeValue, made dispose() idempotent with isDisposed = true, added dispose() call in deinit (#120, #129)
• Fixed: macOS SIGSEGV crash in callAsyncJavaScript — added isDisposed guard to observeValue, added optional chaining on channel?.invokeMethod calls (#126)
• Chore: Updated minimum iOS build version to 16.0

• Feature: WebAuthn (passkey) support — added webAuthenticationSupport setting + WebAuthenticationSupport enum for native passkey authentication in WebViews (Upstream PR #2743 @susemeee)
• Feature: Google Pay support — added paymentRequestEnabled setting for WebViewFeature.PAYMENT_REQUEST (Upstream PR #2722 @AzarouAmine)
• Feature: Audio capture for file picker — added getAudioIntent() for <input type="file" accept="audio/*"> support (Upstream PR #2823 @PrimozRatej)
• Fixed: takeScreenshot now renders content outside the viewport — disabled scrollbars during capture, added layout() before draw() (Upstream PR #2390 @lucasdessy)
• Fixed: AJAX blob interception — use request.response instead of undefined blob variable (Upstream PR #2099 @EArminjon)
• Fixed: Chrome not supported error handling — wrapped onCustomTabsConnected in try-catch with onBrowserNotSupported callback (Upstream PR #2070 @luckyhandler)
• Fixed: Restored working .g.dart files after build_runner regeneration
• Chore: Bumped androidx.webkit:webkit from 1.13.0 to 1.14.0
• Chore: Added generators dependency to platform_interface for proper code generation

• Fixed: Android onWebViewCreated not firing on ~50% release cold starts — deferred JS bridge registration (addJavascriptInterface, addDocumentStartJavaScript) to View.post() so binder IPC doesn't suppress engine's onPlatformViewCreated dispatch
• Fixed: Changed dismissDialogues setting default from true to false (opt-in behavior)
• Fixed: Android 15 edge-to-edge — skip deprecated setNavigationBarColor/setNavigationBarDividerColor APIs on SDK 35+ (PR #2729 @NIKDISSV-Forever)
• Fixed: Java deprecation cleanup — new Handler(Looper.getMainLooper()), clearSessionCookies() helper, @SuppressWarnings on WebViewClient classes (PR #2817 @Khairul989)
• Fixed: KeepAlive NPE — use remove() instead of put(null), copy-on-iterate in dispose() (PR #2638 @mustafayildiz12)
• Fixed: CVE-2020-6563 — sandbox file access protection in file picker (PR #2243 @AlexV525)
• Fixed: debugAssertNotDisposed() crash — use this._channel directly in disposeChannel() (PR #2558 @MSOB7YY)
• Fixed: onCreateWindow URL for window.open() — handle HitTestResult.UNKNOWN_TYPE (PR #1679 @zopagaduanjr)
• Fixed: pana/pub.dev analysis failure — analysis_options.yaml linter rules (PR #2758 @note11g)
• Fixed: Bumped example app AGP 8.4.0 → 8.6.0
• Feature: KeepAlive URL tracking — added currentUrl to InAppWebViewControllerKeepAliveProps (PR #2614 @Hamed233)
• Chore: Added .build/ to .gitignore — removed 3,344 tracked SPM build artifacts
• Chore: Improved changelog generation — root CHANGELOG.md as single source of truth, actual commit messages as fallback instead of generic placeholder
• Chore: Created UPSTREAM_ISSUES_TRIAGE.md — comprehensive triage of all 156 upstream issues
• Chore: Created 72 tracking issues, closed 18 non-applicable, notified 25+ upstream PR authors

• Prepare for publishing version 4.2.2

• Prepare for publishing version 4.2.1

• Prepare for publishing version 4.2.0

• Prepare for publishing version 4.1.0

• Prepare for publishing version 4.0.10

• Prepare for publishing version 4.0.9

• Prepare for publishing version 4.0.8

• Fixed: GetHtml is tested on mac/web

• Fix: updated missing linux package reference

• Updated dependencies to use hosted references

• Fixed: EdgeInsets conversion issue on getHtml

• Fix: Added getHtml method for macos,windows,web,linux platforms

• Updated dependencies to use hosted references

• Prepare for publishing version 4.0.2
• Updated dependencies to use hosted references

• Refactored with Gemini-3-Flash
• Updated dependencies to use hosted references

• fixed cocoapods issues
• Updated dependencies to use hosted references