chore(deps): bump flutter_secure_storage from 9.2.4 to 10.0.0 #36

Closed

dependabot[bot] wants to merge 1 commit from dependabot/pub/flutter_secure_storage-10.0.0 into main

dependabot[bot] commented

2025-12-11 10:35:46 +01:00

(Migrated from github.com)

Bumps flutter_secure_storage from 9.2.4 to 10.0.0.

Release notes

Sourced from flutter_secure_storage's releases.

v10.0.0

This major release brings significant security improvements, platform updates, and modernization across all supported platforms.

Android

Due to the deprecation of Jetpack Security library, the Android implementation has been largely rewritten with custom secure ciphers, enhanced biometrics support, and migration tools.

Breaking Changes:

AndroidOptions().encryptedSharedPreferences is now deprecated due to Jetpack Crypto package deprecation

Migration will automatically happen due to migrateOnAlgorithmChange: true, which can also be set to false if not wanted.

ResetOnError will now automatically be true, because most errors are unrecoverable due to key storage problems. It can still be disabled with resetOnError: false

Default key cipher changed to RSA_ECB_OAEPwithSHA_256andMGF1Padding

Default storage cipher changed to AES_GCM_NoPadding

Minimum Android SDK changed from 19 to 23

Target SDK updated to 36

Migrated from deprecated Jetpack Crypto library to custom cipher implementation (Tink doesn't support biometrics)

Migrated to Java Version 17

New Features:

New named constructors: AndroidOptions(), AndroidOptions.biometric()

AndroidOptions().migrateOnAlgorithmChange automatically migrates data to new ciphers when enabled

Improved biometric authentication with graceful degradation when device has no security setup

Migration tools for transitioning from deprecated encryptedSharedPreferences

Enhanced error handling with proper exception messages for biometric unavailability

Fixes:

Fixed biometric authentication on devices without security (PIN/pattern/password) - now gracefully degrades when enforceBiometrics=false

Fixed storage cipher and key cipher pairing validation

Fixed migration checks for encrypted shared preferences

Fixed biometric permission handling

Fixed exception when reading data after boot

Other Changes:

Updated Gradle, Kotlin, and Tink dependencies

Refactored custom cipher implementations for better maintainability

Added delete key functions for proper reset handling

Migrated to new analyzer and code cleanup

iOS / macOS (darwin)

Merged iOS and macOS implementations into unified flutter_secure_storage_darwin package

Added support for Swift Package Manager

Remove keys regardless of synchronizable state or accessibility constraints

Change minimum iOS version from 9 to 12

Change minimum macOS version to 10.14

Use serial queue for execution of keychain operations

Added privacy manifest

Refactored code and added missing options to IOSOptions and MacOSOptions

Fixed warnings with Privacy Manifest

Fixed delete and deleteAll when synchronizable is set

Fixed migration when value is saved while key already exists with different accessibility option

Use accessibility option for all operations

... (truncated)

Commits

b77fd10 release of v10.0.0
9a1768d imp: update build files
56fc6b4 imp: disable access control for example
6b0d4f4 release of v0.2.0
233308a release of v3.0.0
7f9891a Merge remote-tracking branch 'origin/develop' into develop
7c67f68 release of v2.1.0
f9b8ffe release of v4.1.0
6c00019 Merge pull request #1012fix/issue-#1011
eed5e19fix/issue-#1011
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note

Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [flutter_secure_storage](https://github.com/mogol/flutter_secure_storage) from 9.2.4 to 10.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mogol/flutter_secure_storage/releases">flutter_secure_storage's releases</a>.</em></p> <blockquote> <h2>v10.0.0</h2> <p>This major release brings significant security improvements, platform updates, and modernization across all supported platforms.</p> <h3>Android</h3> <p>Due to the deprecation of Jetpack Security library, the Android implementation has been largely rewritten with custom secure ciphers, enhanced biometrics support, and migration tools.</p> <p><strong>Breaking Changes:</strong></p> <ul> <li><code>AndroidOptions().encryptedSharedPreferences</code> is now deprecated due to Jetpack Crypto package deprecation <ul> <li>Migration will automatically happen due to <code>migrateOnAlgorithmChange: true</code>, which can also be set to false if not wanted.</li> </ul> </li> <li>ResetOnError will now automatically be true, because most errors are unrecoverable due to key storage problems. It can still be disabled with <code>resetOnError: false</code></li> <li>Default key cipher changed to <code>RSA_ECB_OAEPwithSHA_256andMGF1Padding</code></li> <li>Default storage cipher changed to <code>AES_GCM_NoPadding</code></li> <li>Minimum Android SDK changed from 19 to 23</li> <li>Target SDK updated to 36</li> <li>Migrated from deprecated Jetpack Crypto library to custom cipher implementation (Tink doesn't support biometrics)</li> <li>Migrated to Java Version 17</li> </ul> <p><strong>New Features:</strong></p> <ul> <li>New named constructors: <code>AndroidOptions()</code>, <code>AndroidOptions.biometric()</code></li> <li><code>AndroidOptions().migrateOnAlgorithmChange</code> automatically migrates data to new ciphers when enabled</li> <li>Improved biometric authentication with graceful degradation when device has no security setup</li> <li>Migration tools for transitioning from deprecated encryptedSharedPreferences</li> <li>Enhanced error handling with proper exception messages for biometric unavailability</li> </ul> <p><strong>Fixes:</strong></p> <ul> <li>Fixed biometric authentication on devices without security (PIN/pattern/password) - now gracefully degrades when <code>enforceBiometrics=false</code></li> <li>Fixed storage cipher and key cipher pairing validation</li> <li>Fixed migration checks for encrypted shared preferences</li> <li>Fixed biometric permission handling</li> <li>Fixed exception when reading data after boot</li> </ul> <p><strong>Other Changes:</strong></p> <ul> <li>Updated Gradle, Kotlin, and Tink dependencies</li> <li>Refactored custom cipher implementations for better maintainability</li> <li>Added delete key functions for proper reset handling</li> <li>Migrated to new analyzer and code cleanup</li> </ul> <h3>iOS / macOS (darwin)</h3> <ul> <li>Merged iOS and macOS implementations into unified <code>flutter_secure_storage_darwin</code> package</li> <li>Added support for Swift Package Manager</li> <li>Remove keys regardless of synchronizable state or accessibility constraints</li> <li>Change minimum iOS version from 9 to 12</li> <li>Change minimum macOS version to 10.14</li> <li>Use serial queue for execution of keychain operations</li> <li>Added privacy manifest</li> <li>Refactored code and added missing options to IOSOptions and MacOSOptions</li> <li>Fixed warnings with Privacy Manifest</li> <li>Fixed delete and deleteAll when synchronizable is set</li> <li>Fixed migration when value is saved while key already exists with different accessibility option</li> <li>Use accessibility option for all operations</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliansteenbakker/flutter_secure_storage/commit/b77fd10b3c37ff75f5429218afc18d33200961f5"><code>b77fd10</code></a> release of v10.0.0</li> <li><a href="https://github.com/juliansteenbakker/flutter_secure_storage/commit/9a1768d1f156a731beddb13fafb0049c7b1ae737"><code>9a1768d</code></a> imp: update build files</li> <li><a href="https://github.com/juliansteenbakker/flutter_secure_storage/commit/56fc6b458bbc6843239649b28e16c5dc9cbf4487"><code>56fc6b4</code></a> imp: disable access control for example</li> <li><a href="https://github.com/juliansteenbakker/flutter_secure_storage/commit/6b0d4f4a0a6da1824f6769f75918ba652290d9fd"><code>6b0d4f4</code></a> release of v0.2.0</li> <li><a href="https://github.com/juliansteenbakker/flutter_secure_storage/commit/233308a07a12f8c114ca146da4beeeea3a024938"><code>233308a</code></a> release of v3.0.0</li> <li><a href="https://github.com/juliansteenbakker/flutter_secure_storage/commit/7f9891ae2f0ad72375bbd989fbc5d8b12e5da21c"><code>7f9891a</code></a> Merge remote-tracking branch 'origin/develop' into develop</li> <li><a href="https://github.com/juliansteenbakker/flutter_secure_storage/commit/7c67f68dfb83c6596b0884b598d20b90fc324536"><code>7c67f68</code></a> release of v2.1.0</li> <li><a href="https://github.com/juliansteenbakker/flutter_secure_storage/commit/f9b8ffeae8e07e4bb619a430e104b68634f69d63"><code>f9b8ffe</code></a> release of v4.1.0</li> <li><a href="https://github.com/juliansteenbakker/flutter_secure_storage/commit/6c000198b2bbbea4ec03b4a4a8d0f1996547cb53"><code>6c00019</code></a> Merge pull request <a href="https://redirect.github.com/mogol/flutter_secure_storage/issues/1012">#1012</a><code>fix/issue-#1011</code></li> <li><a href="https://github.com/juliansteenbakker/flutter_secure_storage/commit/eed5e19400b0fc0297889ce71fa2399ec3ecd6da"><code>eed5e19</code></a><code>fix/issue-#1011</code></li> <li>Additional commits viewable in <a href="https://github.com/mogol/flutter_secure_storage/compare/v9.2.4...v10.0.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=flutter_secure_storage&package-manager=pub&previous-version=9.2.4&new-version=10.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

sionzee (Migrated from github.com) reviewed

2025-12-11 10:35:46 +01:00