Skip to content

v2.0.1 - Security Fixes, Bug Fixes, and InstantDB v0.3.4

Choose a tag to compare

View all tags
@pillowsoft pillowsoft released this 03 Jan 12:09
· 11 commits to main since this release
v2.0.1
960b572

🔧 v2.0.1 - Security Fixes, Bug Fixes, and InstantDB v0.3.4

This release includes comprehensive improvements across security, stability, and dependencies.

🆕 v2.0.1 Changes (InstantDB Upgrade)

  • ⬆️ Upgraded InstantDB Flutter from v0.3.3 to v0.3.4
    • Fixed clearAll() crash when deleting non-existent database tables
    • Added performance index on retracted column (O(n) → O(log n) query performance)
    • Added vacuum() method to remove old retracted triples and reclaim disk space
    • Server error rollback: Optimistic updates now automatically rollback on server rejection
    • Attribute cache protection: Unknown attributes trigger exceptions to prevent data loss
    • See InstantDB v0.3.4 Release Notes

⚠️ v2.0.0 Changes (Included in this release)

BREAKING CHANGES

  • 🔐 CRITICAL SECURITY FIX: Password hashing upgraded from SHA-256 to bcrypt
    • Impact: Existing password hashes will NOT work after upgrade
    • Why: SHA-256 is vulnerable to rainbow table attacks (no salt, too fast)
    • New: bcrypt with cost factor 12 (industry standard, built-in salt)
    • Migration: See Migration Guide v2.0
    • Note: InstantDB magic link authentication unaffected

🐛 Bug Fixes (10 Critical Issues)

High Priority

  1. DatabaseService race condition - Added untracked() wrapper in watchCollection/watchWhere
  2. AuthenticationService null safety - Atomic signal updates using batch()
  3. NetworkService offline queue - JSON serialization to SharedPreferences

Medium Priority

  1. WindowStateService validation - NaN/Infinity coordinate checks
  2. DatabaseService hardcoded workarounds - Version detection for InstantDB
  3. AppShellSettingsStore silent failures - Error tracking signals added
  4. AppShell back button logic - Pure function with cycle detection

Low Priority

  1. PreferencesService signal leak - Cleanup API added
  2. AppShell route title loop - Cycle detection with depth limits
  3. Password hashing security - See BREAKING CHANGES

📚 Documentation

  • docs/installation.md - Complete setup guide
  • docs/migration-v2.md - Password hashing migration guide
  • docs/quickstart-examples.md - Practical code examples
  • docs/services/authentication.md - Authentication service documentation

🎨 Example App Improvements

  • Fixed 3 pattern violations (removed ui.scaffold() from screens)
  • Enabled Task Manager and Error Handling demos
  • Added FileStorageService demonstration
  • Fixed 4 ButtonVariant usages

📦 Migration from v1.x

If upgrading from v1.x with password-based authentication:

  1. Read the migration guide: docs/migration-v2.md
  2. Choose migration strategy:
    • Option A: Users reset passwords
    • Option B: Migrate on first sign-in using migratePasswordHash()
    • Option C: Clear all auth data
  3. Test thoroughly before deploying

Note: If using InstantDB magic links (recommended), no migration needed!

✅ Testing

  • 15+ tests passing
  • InstantDB v0.3.4 integration verified
  • All platforms tested: iOS, Android, Web, macOS, Windows, Linux

🔗 References

Assets 2
Loading