Native dependencies deps-v4

Prebuilt libcurl + BoringSSL + nghttp2/ngtcp2/nghttp3 + brotli + zstd,
consumed by src/deps.cmake, the CocoaPods podspecs and the SwiftPM
manifests.

Each archive carries a manifest.json recording the exact component
versions, compile flags and build timestamp. Attach it to bug reports.

SHA-256 pins for deps/versions.cmake are in this run's job summary.

Native dependencies deps-v3

Prebuilt libcurl + BoringSSL + nghttp2/ngtcp2/nghttp3 + brotli + zstd,
consumed by src/deps.cmake, the CocoaPods podspecs and the SwiftPM
manifests.

Each archive carries a manifest.json recording the exact component
versions, compile flags and build timestamp. Attach it to bug reports.

SHA-256 pins for deps/versions.cmake are in this run's job summary.

Native dependencies deps-v2

Prebuilt libcurl + BoringSSL + nghttp2/ngtcp2/nghttp3 + brotli + zstd,
consumed by src/deps.cmake, the CocoaPods podspecs and the SwiftPM
manifests.

Each archive carries a manifest.json recording the exact component
versions, compile flags and build timestamp. Attach it to bug reports.

SHA-256 pins for deps/versions.cmake are in this run's job summary.

nitro_http 0.0.1

First release.

A Flutter HTTP client whose entire transport is C++. Requests go straight to a libcurl engine over Nitro's FFI bridge — a direct C++ call, not a method channel — and Dart never touches a socket.

Highlights

• One engine, five platforms. iOS, Android, macOS, Windows and Linux run the same C++, so proxies, TLS pinning, redirects, timeouts and cookies behave identically everywhere — there is no second implementation to disagree with the first.
• HTTP/1.1, HTTP/2 and HTTP/3, negotiated on the engine's own event-loop thread with a shared connection pool. What is actually available depends on the linked libcurl, so the engine queries curl_version_info() at runtime and reports through NitroHttp.supportsHttp3.
• Streaming both directions with real backpressure — a credit window pauses the transfer when Dart falls behind, so a slow consumer throttles the socket instead of buffering without bound. Response chunks reach Dart zero-copy.
• A sealed-class Dart API. HttpBody, HttpResponse and NitroHttpException are sealed, so a switch is exhaustive and the compiler catches an unhandled case.
• Cancellation, progress and per-phase timings (DNS, connect, TLS, TTFB), plus interceptors, retry with backoff, a cookie jar, an RFC-9111-subset disk cache, TLS/mTLS with SPKI pinning, proxies, DNS overrides and DoH, and WebSockets.
• Drop-in adapters for package:http and dio, so existing call sites keep working. The package:http adapter passes the official http_client_conformance_tests suite.

Performance

Fastest of five clients in 13 of 15 cells of the Android stress matrix, and fastest at concurrency and mixed traffic on macOS and iOS too, measured against dart:io, package:http, dio and rhttp in the same run against the same in-process server, in release mode on real hardware. Small single GETs still trail dart:io by the residual FFI round trip. The README carries every number, including the cells it loses, and the methodology.

Native dependencies

Prebuilt libcurl slices ship in the deps-v1 release and are downloaded on demand, each verified against the SHA-256 pinned in deps/versions.cmake — a checksum that does not match fails the build rather than being trusted. To build the stack yourself instead:

flutter pub run nitro_http:build_curl apple     # or android, linux

Point NITRO_HTTP_DEPS_DIR at the result for offline or air-gapped builds.

Requirements

Dart ^3.12.2, Flutter >=3.3.0. Android minSdk 24, iOS 13.0, macOS 10.15. A sandboxed macOS app must declare com.apple.security.network.client.

Known gaps

• No web/WASM support — the engine is native code, and this is a permanent non-goal.
• WebSockets are HTTP/1.1 Upgrade only (RFC 8441 Extended CONNECT is not implemented).
• No public-suffix validation for cookies; libpsl is not vendored yet, so the jar is not a security boundary against a hostile server.
• TlsSettings.sniHostname round-trips through the config but is not yet applied.
• No Windows arm64 slice.

Full detail in CHANGELOG.md.

Native dependencies deps-v1

Prebuilt libcurl + BoringSSL + nghttp2/ngtcp2/nghttp3 + brotli + zstd,
consumed by src/deps.cmake, the CocoaPods podspecs and the SwiftPM
manifests.

Each archive carries a manifest.json recording the exact component
versions, compile flags and build timestamp. Attach it to bug reports.

SHA-256 pins for deps/versions.cmake are in this run's job summary.