[dependabot]

Bumps the pub group with 29 updates in the / directory:

Package	From	To
archive	4.0.9	4.5.2
connectivity_plus	6.1.5	7.3.1
crypto	3.0.7	3.0.8
device_info_plus	11.5.0	12.4.0
dio	5.11.0	5.11.1
file_picker	11.0.1	11.0.3
flutter_bicubic_resize	1.9.0	1.9.1
flutter_riverpod	3.3.1	3.4.3
flutter_secure_storage	10.0.0	10.3.4
image	4.8.0	4.12.0
image_picker	1.2.1	1.2.4
in_app_update	4.2.5	5.0.0
just_audio	0.10.5	0.10.6
local_auth	3.0.1	3.0.2
local_auth_android	2.0.7	2.3.0
local_auth_darwin	2.0.3	2.0.5
mime	2.0.0	2.1.0
mobile_scanner	7.4.0	7.4.2
open_filex	4.7.0	5.0.0
package_info_plus	9.0.1	10.2.2
device_info_plus	12.4.0	13.3.0
file_picker	11.0.3	12.0.0-beta.7
path_provider	2.1.5	2.1.6
permission_handler	12.0.1	13.0.2
photo_manager	3.9.0	3.12.0
pointycastle	3.9.1	4.0.0
pub_semver	2.2.0	2.2.1
shared_preferences	2.5.5	2.5.6
url_launcher	6.3.2	6.3.3
uuid	4.5.3	4.6.0
video_player	2.11.1	2.14.1

Updates archive from 4.0.9 to 4.5.2

Changelog

Sourced from archive's changelog.

4.5.2

• Fixed ZipDecoder.decodeStream returning an empty archive when the input was not at position 0, such as after reading a magic number or decoding the same stream a second time (#405). decodeStream also leaves the input's read position where it was.
• Added InputStream.totalLength, the size of the whole stream whatever the read position, where length is only the bytes after it.

4.5.1

• Fixed zips written on the web, which decoded to nothing: the zlib encoder left the zip encoder's output big-endian, so every header after the first entry's data was written in the wrong byte order (#419).
• ZipEncoder can be used under dart2js on Node, where creating its secure random source threw; it is now only created for a password.
• Fixed zips written by ZipEncoder since 4.4.0, which 7-Zip reported as having header errors: the data descriptor flag was set in each entry's local header but not its central directory header. The UTF-8 flag also went into the central directory even for names that were not UTF-8.
• Directory entries are stored rather than written as an empty deflate stream, which unzip rejected, and carry the MS-DOS directory attribute. In a zip with a password they are no longer marked encrypted.
• Entries whose content is in memory, and stored entries that can be read twice, have their CRC and sizes in the local header again rather than in a data descriptor after the data. Java's ZipInputStream refuses a stored entry with a descriptor, and OpenDocument and EPUB files need their stored mimetype entry without one (#421).

4.5.0

• Security: XZDecoder hung forever on a truncated .xz read from a file or a decode stream, including .tar.xz in extractFileToDisk.
• Security: tar long name and pax header entries are limited to TarFile.maxMetadataSize (1 MB). A small .tar.gz could declare one large enough to take gigabytes of memory to read.
• Security: decoding had no output limit, so a small archive could expand to fill memory or disk. Added maxOutputSize to decodeBytes and decodeStream on GZipDecoder, ZLibDecoder, BZip2Decoder and ZstdDecoder, and maxSize to extractFileToDisk, extractArchiveToDisk and extractArchiveToDiskSync.
• A zip entry is no longer decoded past the uncompressed size the archive gives for it, so ArchiveFile.size can be checked before reading.
• Security: ZstdDecoder sized its window and output from the frame header, so a 10 byte input committed hundreds of MB, even past maxWindowSize. The content size is now checked as each block decodes, and one that overflows is refused.
• Security: XZDecoder limits the LZMA2 dictionary an archive may declare

... (truncated)

Commits

• See full diff in compare view

Updates connectivity_plus from 6.1.5 to 7.3.1

Commits

• 13e1704 chore(release): prepare for release (#3939)
• eedc414 ci(connectivity_plus): fix macOS/iOS example build with Swift Package Manager...
• bab4cd3 fix(connectivity_plus): prevent Linux client leaks (#3929)
• 9336187 chore(release): prepare for release (#3928)
• a020759 docs(connectivity_plus): Update min iOS and MacOS in README (#3926)
• bf04cdf fix(connectivity_plus): guard eventSink after engine teardown (iOS) (#3797)
• 4c623ae feat(connectivity_plus): add hasConnectivity() utility extension (#3842)
• b3bb72e fix(connectivity_plus): raise Apple platform minimums in SPM manifests to mat...
• c876d41 fix(connectivity_plus): use Windows list manager events (#3829)
• 3e150ba fix(connectivity_plus): improve network callback unregistration handling (#3681)
• Additional commits viewable in compare view

Updates crypto from 3.0.7 to 3.0.8

Release notes

Sourced from crypto's releases.

package:crypto v3.0.8

• Fix the sink returned by Hmac.startChunkedConversion not emitting a digest when addSlice is called with isLast: true.

• Drop unused pkg:typed_data dependency.

• Work-around dart-lang/sdk#63747.

• Speedup hashing 4 KiB inputs relative to version 3.0.7:

  Hash	AOT	dart2js	dart2wasm
  md5	1.2x	6.2x	1.4x
  sha224/sha256	1.35x	1.15x	1.05x
  sha384/sha512	3.1x	6.0x	5.1x

Commits

• 6903c6c [crypto] Prepare to publish 3.0.8 (#1026)
• f01024f [collection] Share Iterable and Set tests across wrapper_test.dart (#1028)
• c782eab Update convert package README and add examples (#999)
• 04da676 Remove dart:mirrors from package:collection test/wrapper_test.dart (#1027)
• f0d9935 [crypto] Don't end comment lines with a URL followed by a period (#1025)
• 5283f88 [crypto] Fix Hmac sink addSlice with isLast not emitting the digest (#1021)
• f5c8490 [crypto] Rotate the working variables in the SHA-256 compression loop (#1023)
• 3e29ec0 [crypto] Speed up the 64-bit SHA-512 sinks on the VM (#1022)
• 2c1dd6d [crypto] Add NIST SHA-384/512 and SHA-1 Monte vectors and chunked conversion ...
• 6f61929 [crypto] Add prefer-inline pragmas to the 32-bit SHA-512 helpers (#1019)
• Additional commits viewable in compare view

Updates device_info_plus from 11.5.0 to 12.4.0

Commits

• c46ab89 chore(release): prepare for release (#3785)
• 5dbe0a9 feat(device_info_plus): Add iOS device identifiers for 2026 models (#3776)
• 25bbcce feat(device_info_plus): Add support for isiOSAppOnVision property in iOS devi...
• 096fd4e chore(release): prepare for release (#3720)
• 61786a1 feat(device_info_plus): Add identifiers for iPad Pro 11-Inch (M5) models (#3708)
• b64f663 chore(release): prepare for release (#3701)
• b4dbd14 feat(device_info_plus): Add missing device identifiers for Macs on M4 (#3700)
• 4cc3f07 feat(device_info_plus): Add identifiers for new Apple devices on M5 chip (#3698)
• 5040a78 fix(device_info_plus): correct Mac model name mappings (#3690)
• 19138be chore(release): prepare for release (#3678)
• Additional commits viewable in compare view

Updates dio from 5.11.0 to 5.11.1

Release notes

Sourced from dio's releases.

dio 5.11.1

What's new

• Fix response stream not propagating backpressure to the underlying socket. When a consumer paused the stream, the source subscription was never paused, so the network kept buffering response data into memory, risking OOM on constrained platforms.
• Make the badCertificateCallback pinning test deterministic by pinning a fingerprint that cannot match the served certificate, instead of relying on badssl.com hosts serving different certificates.
• Fix NoSuchMethodError when using a class that implements Interceptor instead of extends Interceptor. The interceptor pipeline was calling private dispatch methods that only exist on Interceptor subclasses, breaking any class using interface implementation.

Commits

• 4684e29 🔖 dio v5.11.1
• 96b10c7 🔖 web_adapter v2.2.2
• 6d18c7c 🔖 http2_adapter v2.9.0
• debe58c ✨ Deprecate misspelled handshakeTimout in favor of handshakeTimeout (#2595)
• 6c1033e 🐛 Expose supportedProtocols on ConnectionManager to fix fallback for RFC-stri...
• 6d39187 💚 Fail web test runs on the first failing compiler round (#2594)
• a3238c3 fix(dio): support classes that implement Interceptor (#2591)
• fd1cca0 fix(web): classify XHR timeout by connection phase (#2593)
• 83fd107 💚 Adopt CI to Flutter 3.47 (#2592)
• a553f46 Update README for clarity and remove star history (#2589)
• Additional commits viewable in compare view

Updates file_picker from 11.0.1 to 11.0.3

Release notes

Sourced from file_picker's releases.

11.0.2

What's Changed

• fix: Applied the v11 changes that were missing from the document and corrected various typos by @​jooy2 in miguelpruivo/flutter_file_picker#1977
• fix(linux): resolve Cannot add to a fixed-length list (#1976) by @​vicajilau in miguelpruivo/flutter_file_picker#1978
• fix(android): mitigate CWE-22 path traversal vulnerability in FileUtils by @​vicajilau in miguelpruivo/flutter_file_picker#1979

New Contributors

• @​jooy2 made their first contribution in miguelpruivo/flutter_file_picker#1977

Full Changelog: vicajilau/flutter_file_picker@v11.0.1...v11.0.2

Commits

• See full diff in compare view

Updates flutter_bicubic_resize from 1.9.0 to 1.9.1

Changelog

Sourced from flutter_bicubic_resize's changelog.

[1.9.1] - 2026-10-15

Fixed

• Heap overflow on very large output sizes. Native buffer sizes were computed as int, so an output such as 40000x40000 wrapped to a small allocation that the resizer then wrote past. Every native entry point now rejects pixel buffers larger than 2^31 - 1 bytes with invalidDims.
• Out-of-bounds read on malformed EXIF. A JPEG whose EXIF IFD offset was huge (for example 0x80000000) made the orientation parser read before the input buffer and crash. The offset is now bounds-checked and parsing stays inside the APP1 segment; bad EXIF falls back to normal orientation.
• Allocation failures inside the JPEG/PNG encoder or the resizer are reported as allocFailed instead of crashing on a NULL buffer or returning success with an unfilled output.

Added

• Native C regression tests (test/native/resize_test.c) built with AddressSanitizer in CI.

Commits

• b3b77e6 Merge pull request #11 from erykkruk/fix/native-memory-safety
• 5e40562 fix: declare the analyzer excludes Flutter's migration requires
• 982414c docs: add repository CLAUDE.md for contributors
• ecbc0e0 chore: bump version to 1.9.1
• c3fc45f fix(native): guard buffer size overflow and harden EXIF parsing
• See full diff in compare view

Updates flutter_riverpod from 3.3.1 to 3.4.3

Commits

• 128a8ca The following packages have been updated:
• c12fab8 Changelog
• 64e328d Allow analyzer 14 (#4861)
• 693a2db docs: document UnmountedRefException behavior change in 3.0 migration guide (...
• 3104958 Merge branch 'master' of https://github.com/rrousselGit/riverpod
• e06b38c Unnecessary override
• efbe4ed docs: fix invalid ref.state in 3.0 migration AsyncNotifier example (#4855)
• 9f64f67 Bump shimmer from 3.0.0 to 4.0.0 (#4859)
• ba9905e Bump dio from 5.10.0 to 5.11.0 (#4852)
• 47ad9a2 Update codegen
• Additional commits viewable in compare view

Updates flutter_secure_storage from 10.0.0 to 10.3.4

Release notes

Sourced from flutter_secure_storage's releases.

flutter_secure_storage: v10.3.2

Backport release for the v10 line. 11.0.0 remains the current major version.

10.3.2 (2026-09-09)

Android

• Fixed data loss when switching between sharedPreferencesName and storageNamespace with the same name; the wrapped key is now moved to the new location instead of the store starting empty.
• Fixed v9 data with a non-default keyCipherAlgorithm/storageCipherAlgorithm being discarded on upgrade: its algorithm markers were stored where v10 doesn't look, so a failed migration deleted it. Markers are now read from the v9 location, and unmarked data that still decrypts with the current cipher is left alone.
• Fixed AES-GCM data from v9 becoming unreadable: v9's wrapped-key preference name had a typo that v10 corrected, and is now read as a fallback.
• Fixed migrateWithBackup ignoring storageNamespace and backing up the wrong key storage file.
• Fixed a migration running on a fresh install, which could fail on some devices' KeyStore.
• Fixed a NullPointerException when a storage call ran after the Flutter engine detached; it now throws a catchable INIT_FAILED PlatformException.

Commits

• 692a374 Merge pull request #1261 from juliansteenbakker/fix/biometric-multi-instance-...
• 16b0924 docs: trim and tighten comments added on this branch
• f122654 doc: update doc
• 23a5d7d Merge branch '10.x' into fix/biometric-multi-instance-race
• b96721b doc: update doc
• 0ca5c3c Merge pull request #1260 from juliansteenbakker/fix/legacy-namespace-key-reco...
• 20b7011 chore: consolidate into a single v10.3.4 release
• 7279651 release of v10.3.6
• cc8c73b release of v10.3.4
• 0aadfa9 fix(android): don't touch a sibling instance's Keystore key on a fresh install
• Additional commits viewable in compare view

Updates image from 4.8.0 to 4.12.0

Changelog

Sourced from image's changelog.

4.12.0

Security fixes for decoding untrusted images:

• Fix EXIF data with looping IFDs hanging the decoder.
• Fix TIFF files with looping IFDs hanging the decoder, also from decodeImage.
• Add maxPixels to every decoder, defaulting to Decoder.defaultMaxPixels; it also limits animations.
• Deprecate JpegDecoder.defaultMaxPixels for Decoder.defaultMaxPixels.
• Reject BMP, PNM and EXR data too short for its size, and bound EXR tiles.
• Fix ICO entries encoded as animated PNGs.
• Fix isValidFile throwing on short data, which made decodeImage throw.
• Fix PVR3 files not being detected or decoded.
• Decoders throw only ImageException for bad data, not RangeError or other errors.
• Encoders throw ImageException for empty images, and Image rejects negative sizes.
• Limit decompressed sizes for TIFF, EXR, ICC profiles and font zips.
• Limit JPEGs to 1000 scans.
• Fix executeCommandImageAsync and executeCommandBytesAsync never completing when a command throws.
• Fix fillFlood overflowing the stack on large shapes, filling only part of a shape, and clearing alpha.
• Check TIFF tag counts against the file size before reading them.
• Fix quadratic time building EXR PIZ Huffman tables.
• Reject PSD files far too small for their channel data.
• Fix drawString with wrap redrawing each line for every word.
• Fix PNG row sizes overflowing for very wide images on the web.

4.11.1

• Fix dependency constraint to archive 4.4.0.

4.11.0

• Fix encodeJpg modifying the pixels of RGBA source images.
• Fix gaussianBlur and separableConvolution only blurring the first frame.
• Fix gaussianBlur and separableConvolution crashing when the radius is larger than the image.
• Fix trim copying the first frame into every frame.
• Fix GifEncoder.ditherStrength being ignored after the first frame.
• Fix flip (both directions) and bakeOrientation (orientation 3) not flipping the middle row of odd-height images.
• Fix 16-bit grayscale PNG transparency (tRNS) being ignored.
• Fix 8-bit grayscale BMP encoding writing the wrong grays.
• Fix TGA encoding of grayscale and grayscale+alpha images.
• Fix Image.convert(withPalette: true) modifying the source image.
• Fix ditherImage crashing on palette images.
• Fix the last pixel of cleared GIF animation frames.
• Fix cubic interpolation sampling outside the image near the top and left edges, which brightened or darkened them.
• Fix OutputBuffer growth taking quadratic time; 8-bit BMP encoding is ~5x faster.
• Faster BMP, TGA and TIFF encoding, using less memory.
• Faster JPEG decoding; baseline images are decoded a band at a time, using

... (truncated)

Commits

• d9e495c update archive dep to 4.5.0
• b823534 v4.12.0
• 6b79f1c Check animation size before decoding
• d48dcf3 Fix PNG row size overflow on the web
• ac0ce73 Fix drawString wrap redrawing lines
• 18915cd Reject PSD data too small for its size
• 30778b7 Fix quadratic EXR Huffman table build
• 2f949f3 Check TIFF tag counts
• 4a32468 Fix fillFlood stack overflow and fills
• 320f5eb Fix async commands hanging on errors
• Additional commits viewable in compare view

Updates image_picker from 1.2.1 to 1.2.4

Commits

• 7660d46 [image_picker] Document that retrieving lost data is a one-time operation (#1...
• 72fcf09 [image_picker] Subsample large images when resizing on Android (#13038)
• 6d17b57 [various] Update Robolectric to 4.17 (#13041)
• 0ba9a82 [image_picker_ios] PR 1/5 Add injectable protocol seams and migrate leaf nati...
• 000643a Enable Built-in Kotlin in all Flutter Android Plugin Example Apps (#12883)
• d8933fd Plugin example apps to 9.3.1 (#13019)
• 0851c39 [image_picker] Fix scaling 10-bit images (#12557)
• a207941 [ci] Update repo for 3.47 stable release (#12959)
• c177dfc [image_picker] Handle a null stream from openInputStream (#12718)
• cde74b6 [image_picker] Add native tests for photo-library access and UIImagePicker co...
• Additional commits viewable in compare view

Updates in_app_update from 4.2.5 to 5.0.0

Changelog

Sourced from in_app_update's changelog.

5.0.0

• Breaking: requires Flutter 3.44 / Dart 3.12 or newer.
• Migrate to Flutter's built-in Kotlin: the plugin no longer applies the Kotlin Gradle Plugin or declares its classpath, and uses the kotlin { compilerOptions } DSL instead of kotlinOptions (fixes #137)

Commits

• See full diff in compare view

Updates just_audio from 0.10.5 to 0.10.6

Commits

• 454a24c Merge branch 'feature/agp9' into minor
• a5521fd Support AGP 9, migrate build files to .kts
• See full diff in compare view

Updates local_auth from 3.0.1 to 3.0.2

Commits

• 84e73e8 [local_auth] Clarify getAvailableBiometrics documentation regarding iOS permi...
• bd297cf [AGP 9] Migrate Remaining Plugin Example Apps to Built-in Kotlin (#11806)
• 24a3833 Updated analysis_options line width from flutter/flutter (#11692)
• 6441245 [AGP 9] Migrate plugins to support AGP 9 (#11802)
• 1dfbada [ci] Update repo for 3.44 stable release (#11741)
• 0ffbde8 Roll Flutter from 707dbc0420a3 to 23f6f5853f50 (149 revisions) (#11700)
• bf6d7db [various] Upgrade googletest to v1.15.2 (#11586)
• 41628b5 [local_auth] Switch to Kotlin Pigeon (#11482)
• e37fa8f [various] Convert remaining Groovy files to Kotlin (#11443)
• 0e0a032 [various] Ignore generated plugin files (#11455)
• Additional commits viewable in compare view

Updates local_auth_android from 2.0.7 to 2.3.0

Commits

• ca5b2e5 [local_auth] Convert Android to new Pigeon suspend support (#12894)
• 6d17b57 [various] Update Robolectric to 4.17 (#13041)
• 000643a Enable Built-in Kotlin in all Flutter Android Plugin Example Apps (#12883)
• d8933fd Plugin example apps to 9.3.1 (#13019)
• a207941 [ci] Update repo for 3.47 stable release (#12959)
• c6d0c25 [local_auth] Convert tests to Kotlin (#12884)
• c2b58e1 [local_auth] Convert implementation to Kotlin (#12635)
• 9854cd5 [various] Update pigeon dev_dependency to ^27.3.2 (#12615)
• 6969329 [packages] Migrate all iOS example apps in flutter/packages to UIScene (#12182)
• 97438f1 [various] Convert example boilerplate from Java to Kotlin (#12201)
• Additional commits viewable in compare view

Updates local_auth_darwin from 2.0.3 to 2.0.5

Commits

• f8262d2 [local_auth_darwin] Fix Swift 6 concurrency analyzer errors from lifecycle de...
• 2625b7f [various] Update iOS example apps to the 15.0 deployment target (#13223)
• ca5b2e5 [local_auth] Convert Android to new Pigeon suspend support (#12894)
• 6d17b57 [various] Update Robolectric to 4.17 (#13041)
• 000643a Enable Built-in Kotlin in all Flutter Android Plugin Example Apps (#12883)
• d8933fd Plugin example apps to 9.3.1 (#13019)
• a207941 [ci] Update repo for 3.47 stable release (#12959)
• c6d0c25 [local_auth] Convert tests to Kotlin (#12884)
• c2b58e1 [local_auth] Convert implementation to Kotlin (#12635)
• 9854cd5 [various] Update pigeon dev_dependency to ^27.3.2 (#12615)
• Additional commits viewable in compare view

Updates mime from 2.0.0 to 2.1.0

Release notes

Sourced from mime's releases.

package:mime v2.1.0

• Switched to using the Apache httpd mime.conf table as the source of truth for mime types. Mime type additions:

• application/vnd.geogebra.slides
• font/collection
• image/jxl
• image/vnd.dvb.subtitle
• video/mp2t Renamed mime types:
• application/x-font-otf => font/otf
• application/x-font-ttf => font/ttf
• application/x-font-woff => font/woff Removed mime types:
• model/vnd.mts Mime types where the default file extension changed:
• application/inkml+xml, inkml => ink
• application/octet-stream, so => bin
• application/onenote, onetoc2 => onetoc
• application/pgp-signature, sig => asc
• application/tei+xml, teicorpus => tei
• application/vnd.adobe.fxp, fxpl => fxp
• application/vnd.clonk.c4group, c4u => c4g
• application/vnd.dece.data, uvvf => uvf
• application/vnd.dece.ttml+xml, uvvt => uvt
• application/vnd.eszigno3+xml, et3 => es3
• application/vnd.framemaker, maker => fm
• application/vnd.geometry-explorer, gre => gex
• application/vnd.grafeq, gqs => gqf
• application/vnd.ibm.modcap, listafp => afp
• application/vnd.iccprofile, icm => icc
• application/vnd.intercon.formnet, xpx => xpw
• application/vnd.kde.kpresenter, kpt => kpr
• application/vnd.kde.kword, kwt => kwd
• application/vnd.kinar, knp => kne
• application/vnd.koan, skt => skp
• application/vnd.ms-project, mpt => mpp
• application/vnd.palm, pqa => pdb
• application/vnd.quark.quarkxpress, qxt => qxd
• application/vnd.simtech-mindmapper, twds => twd
• application/vnd.stardivision.writer, vor => sdw
• application/vnd.sus-calendar, susp => sus
• application/vnd.symbian.install, sisx => sis
• application/vnd.ufdl, ufdl => ufd
• application/vnd.visio, vsw => vsd
• application/vnd.zul, zirz => zir
• application/x-authorware-bin, x32 => aab
• application/x-blorb, blorb => blb
• application/x-cbr, cbz => cbr
• application/x-director, w3d => dir

... (truncated)

Commits

• c7f7a63 Prepare to publish packages (#2562)
• 3b3b22c [extension_discovery] Fixup review comments (#2557)
• 441ff29 [unified_analytics]Add an 'is_external' const to indicate external builds (#2...
• 5f02a37 Fix trailing comma when adding to flow collections in yaml_edit (#2533)
• 7a3be9a [unified_analytics] Prepare for 8.0.18 release (#2559)
• 59c163c [unified_analytics] Add hostArch parameter to Event.flutterCommandResult (#2558)
• 8108a7c [extension_discovery] Prevent config.yaml symlinks from escaping package boun...
• 3de16a5 fix(coverage): reject file: URIs outside known roots in Resolver (#2534)
• 1723b1e [html]: add minimal differential testing framework (#2554)
• 7dc3279 fix: reconcile version mismatches in process and stack_trace (#2546)
• Additional commits viewable in compare view

Updates mobile_scanner from 7.4.0 to 7.4.2

Release notes

Sourced from mobile_scanner's releases.

v7.4.2

7.4.2 (2026-09-10)

Bug Fixes

• android: defer orientation sensor listener until camera start (#1803) (f9c81ea)

v7.4.1

Improvements

• [Web] Bumped zxing-wasm (the WebBarcodeReader.zxingWasm backend) from 3.1.1 to 3.1.3.

Bug Fixes

• [Android] Fixed the camera preview reporting a stale device orientation on start, when the device was rotated while the camera was stopped.
• [Android] Fixed device rotations sometimes not being detected while the camera is running, e.g. when the display rotation callback fires before the display reflects the new rotation, or on a seamless 180 degree rotation between the two landscape orientations.
• [Android] Fixed barcode scanning permanently stalling when a camera frame was never released. The ImageProxy is now released on every exit path of the analyzer, including a null image, a failed or cancelled ML Kit request, and any error while building the input image or handling the result. Previously a single leaked frame stopped all further scanning while the preview kept running. (thanks @​WladmirJunior !)
• [Android] Fixed a host-app crash when CameraX fails to initialize while starting the scanner (e.g. "Available cameras: 0", the camera being held by another process, or a transient HAL error). The failure is now routed through the normal error callback so it can be surfaced via errorBuilder instead of terminating the app.
• [Android] Fixed the false-positive Your app uses the following plugins that apply Kotlin Gradle Plugin (KGP): mobile_scanner warning on AGP 9. The plugin's Gradle files are now Kotlin DSL, and the Kotlin Gradle Plugin is only applied when built-in Kotlin is disabled, which keeps the build working on older AGP versions. (thanks @​AndresMontaniv !)
• [Android] Added a ProGuard keep rule for the internal ML Kit barcode classes (com.google.android.gms.internal.mlkit_vision_barcode), which could be stripped or obfuscated in release builds.
• [Apple] Fixed a crash when the app is terminated while the camera is running. A capture frame that was still in flight could reach the Flutter engine after its shell had been destroyed, causing an EXC_BAD_ACCESS. The capture session is now stopped before the engine is destroyed, and the camera is released when the engine detaches the plugin.
• [Web] Fixed web builds failing to compile on Dart 3.14 (Flutter 3.48), which rejects @JS annotations on extension type constructors. The annotations were already no-ops, so removing them does not change any behavior.
• Fixed the camera preview no longer following device rotation after switchCamera(). Restarting the camera recreated the device orientation stream, and cancelling a listener of the previous stream instance afterwards inadvertently tore down the platform channel of the new one.

Changelog

Sourced from mobile_scanner's changelog.

7.4.2 (2026-09-10)

Bug Fixes

• android: defer orientation sensor listener until camera start (#1803) (f9c81ea)

7.4.1

Improvements

• [Web] Bumped zxing-wasm (the WebBarcodeReader.zxingWasm backend) from 3.1.1 to 3.1.3.

Bug Fixes

• [Android] Fixed the camera preview reporting a stale device orientation on start, when the device was rotated while the camera was stopped.
• [Android] Fixed device rotations sometimes not being detected while the camera is running, e.g. when the display rotation callback fires before the display reflects the new rotation, or on a seamless 180 degree rotation between the two landscape orientations.
• [Android] Fixed barcode scanning permanently stalling when a camera frame was never released. The ImageProxy is now released on every exit path of the analyzer, including a null image, a failed or cancelled ML Kit request, and any error while building the input image or handling the result. Previously a single leaked frame stopped all further scanning while the preview kept running. (thanks @​WladmirJunior !)
• [Android] Fixed a host-app crash when CameraX fails to initialize while starting the scanner (e.g. "Available cameras: 0", the camera being held by another process, or a transient HAL error). The failure is now routed through the normal error callback so it can be surfaced via errorBuilder instead of terminating the app.
• [Android] Fixed the false-positive Your app uses the following plugins that apply Kotlin Gradle Plugin (KGP): mobile_scanner warning on AGP 9. The plugin's Gradle files are now Kotlin DSL, and the Kotlin Gradle Plugin is only applied when built-in Kotlin is disabled, which keeps the build working on older AGP versions. (thanks @​AndresMontaniv !)
• [Android] Added a ProGuard keep rule for the internal ML Kit barcode classes (com.google.android.gms.internal.mlkit_vision_barcode), which could be stripped or obfuscated in release builds.
• [Apple] Fixed a crash when the app is terminated while the camera is running. A capture frame that was still in flight could reach the Flutter engine after its shell had been destroyed, causing an EXC_BAD_ACCESS. The capture session is now stopped before the engine is destroyed, and the camera is released when the engine detaches the plugin.
• [Web] Fixed web builds failing to compile on Dart 3.14 (Flutter 3.48), which rejects @JS annotations on extension type constructors. The annotations were already no-ops, so removing them does not change any behavior.
• Fixed the camera preview no longer following device rotation after switchCamera(). Restarting the camera recreated the device orientation stream, and cancelling a listener of the previous stream instance afterwards inadvertently tore down the platform channel of the new one.

Commits

• 34f5050 chore(develop): release 7.4.2 (#1804)
• f9c81eaDescription has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.