[dependabot]

Bumps the mobile-dependencies group in /mobile with 3 updates: archive, mqtt_client and xml.

Updates archive from 3.6.1 to 4.5.2

Changelog

Sourced from archive's changelog.

4.5.2

• Fixed ZipDecoder.decodeStream returning an empty archive when the input was not at position 0, such as after reading a magic number or decoding the same stream a second time (#405). decodeStream also leaves the input's read position where it was.
• Added InputStream.totalLength, the size of the whole stream whatever the read position, where length is only the bytes after it.

4.5.1

• Fixed zips written on the web, which decoded to nothing: the zlib encoder left the zip encoder's output big-endian, so every header after the first entry's data was written in the wrong byte order (#419).
• ZipEncoder can be used under dart2js on Node, where creating its secure random source threw; it is now only created for a password.
• Fixed zips written by ZipEncoder since 4.4.0, which 7-Zip reported as having header errors: the data descriptor flag was set in each entry's local header but not its central directory header. The UTF-8 flag also went into the central directory even for names that were not UTF-8.
• Directory entries are stored rather than written as an empty deflate stream, which unzip rejected, and carry the MS-DOS directory attribute. In a zip with a password they are no longer marked encrypted.
• Entries whose content is in memory, and stored entries that can be read twice, have their CRC and sizes in the local header again rather than in a data descriptor after the data. Java's ZipInputStream refuses a stored entry with a descriptor, and OpenDocument and EPUB files need their stored mimetype entry without one (#421).

4.5.0

• Security: XZDecoder hung forever on a truncated .xz read from a file or a decode stream, including .tar.xz in extractFileToDisk.
• Security: tar long name and pax header entries are limited to TarFile.maxMetadataSize (1 MB). A small .tar.gz could declare one large enough to take gigabytes of memory to read.
• Security: decoding had no output limit, so a small archive could expand to fill memory or disk. Added maxOutputSize to decodeBytes and decodeStream on GZipDecoder, ZLibDecoder, BZip2Decoder and ZstdDecoder, and maxSize to extractFileToDisk, extractArchiveToDisk and extractArchiveToDiskSync.
• A zip entry is no longer decoded past the uncompressed size the archive gives for it, so ArchiveFile.size can be checked before reading.
• Security: ZstdDecoder sized its window and output from the frame header, so a 10 byte input committed hundreds of MB, even past maxWindowSize. The content size is now checked as each block decodes, and one that overflows is refused.
• Security: XZDecoder limits the LZMA2 dictionary an archive may declare

... (truncated)

Commits

• See full diff in compare view

Updates mqtt_client from 10.12.0 to 10.13.0

Changelog

Sourced from mqtt_client's changelog.

10.13.0

• PR 651

Commits

• 3e89bc7 Release 10.13.0
• aa29ba4 feat: Apply connectionTimeout to websocket connections (#651) (#652)
• See full diff in compare view

Updates xml from 6.6.1 to 7.1.0

Changelog

Sourced from xml's changelog.

7.1.0

• Dart 3.13 and PetitParser 7.1.0 requirement.
• Standard-compliant DOM position comparison:
  • Introduced XmlNode.compareDocumentPosition returning XmlDocumentPosition bitmask flags (isSame, isDisconnected, isPreceding, isFollowing, isContains, isContainedBy, isImplementationSpecific), matching W3C DOM Level 3 / DOM 4.
  • Deprecated XmlNode.compareNodePosition in favor of compareDocumentPosition.
• XML attribute and namespace separation:
  • Added XmlAttribute.isNamespaceDeclaration to distinguish namespace declarations (xmlns or xmlns:*) from regular attributes.
  • Added elementAttributes getter on XmlAttributesBase and XmlHasAttributes to iterate over attributes excluding namespace declarations.
• XPath 3.1 enhancements and W3C compliance:
  • Excluded namespace declarations from the attribute axis (@*), aligning with XPath 3.1 specification.
  • Restored document order for reverse-indexed axes with predicates.
  • Implemented canonical EQName path generation in fn:path (/Q{uri}name[idx], @Q{uri}name, text()[idx]).
  • Improved ID and IDREF resolution in fn:id, fn:idref, and fn:element-with-id with xml:id and DTD <!ATTLIST ... ID/IDREF> attribute declarations.
  • Introduced XPathConfiguration to configure evaluation contexts (custom variables, functions, namespaces, documents, environment variables, base URI, unparsed text loader, and trace callback). Deprecated passing variables and functions directly to xpath and xpathEvaluate.
  • Added XML serialization (fn:serialize) supporting XML, HTML, XHTML, text, JSON, and adaptive output methods with serialization parameters.
  • Added PetitParser-based regular expression transformer for XML Schema regex syntax supporting fn:matches, fn:replace, fn:tokenize, and fn:analyze-string.
  • Added fn:parse-ietf-date.
  • Standardized error handling with XPathErrorCode and W3C error codes.
  • Redesigned date, time, and duration types (xs:duration, xs:dayTimeDuration, xs:yearMonthDuration, xs:dateTime, xs:date, xs:time, and Gregorian date types) for strict W3C compliance.
  • Added support for xs:anyAtomicType, xs:error, and string-derived XML Schema constructors.
  • Added support for unparsed text and JSON document retrieval (fn:unparsed-text, fn:unparsed-text-lines, fn:unparsed-text-available, fn:json-doc) via unparsedTextLoader.
  • Added context-aware document lookup (fn:doc, fn:doc-available) and cross-platform environment variable resolution (fn:environment-variable, fn:available-environment-variables).
  • Added support for key sequences and native Dart Map and List structures in lookup expressions (?).
  • Integrated maps and arrays into dynamic function calls.
  • Added duration support in aggregation functions (fn:avg, fn:sum).
  • Protected arithmetic and math functions (fn:ceiling, fn:floor, duration operations) against Infinity and NaN.
  • Significant XPath evaluation performance optimizations:
    • Preserved document order on absolute paths (/, //), avoiding redundant sorting and deduplication fallbacks. Yields up to 775x speedup on large documents (e.g., at $N=10,000$, //* is ~775x faster dropping from 3.75s to 4.8ms; /root/item/name is ~609x faster dropping from 840ms to 1.38ms; //item is ~307x faster dropping from 870ms to 2.84ms).
    • Introduced two-tier node sorting with direct sibling indexing in DOM position comparisons for queries requiring deduplication.
    • Collapsed DescendantOrSelfAxis + ChildAxis into DescendantAxis for steps with non-positional predicates (e.g., //item[@id=100] is ~5.75x faster).
    • Cached small XPathInteger instances (0..128) and unboxed integer comparisons for zero-allocation positional predicate matching with early-exit loop termination.
    • Optimized sequence atomization with zero-allocation fast paths for empty and single-item sequences, along with primitive 1-vs-1 comparison fast paths.
  • Fix short-circuit evaluation for != general comparisons (#207).
  • Removed @experimental annotation from XPath API.
• Add command-line XPath evaluation example tool (example/xml_xpath.dart).

7.0.1

• Better namespace support across all parts of the library:
  • Namespaces of XmlDocument.parse and XmlDocumentFragment.parse are now resolved at parse-time and constant when manipulating the DOM (this aligns with other XML libraries and removes surprising behavior when moving nodes around).
  • Deprecate all namespace arguments and replace them with the more intention revealing namespaceUri and namespacePrefix.
  • Lower-level parser and event APIs can now enable and disable the validation and resolution of namespaces with validateNamespaces and withNamespaces. This is a BREAKING CHANGE to existing code using these lower-level APIs, as namespaces are no longer available by default.
  • Introduced XmlNamespaceException for error reporting of invalid namespaces.
  • XmlName is now immutable and the complexity with different states is gone.
  • Added XmlNamespace node type and XmlHasNamespaces mixin to support reading in-scope namespaces on nodes.
• Correctly move nodes from their previous parent when inserting them into a new location, rather than throwing an XmlParentException. This aligns with standard DOM behavior and improves usability and performance. XmlDocumentFragment nodes are automatically expanded and their children are moved as well.
• Improved performance and usability of XmlBuilder:
  • Significantly improve the performance of XmlBuilder as all namespace lookups are now in constant time.
  • Deprecated namespace(String uri, String? prefix) and namespaces(Map<String, String?> uriToPrefix) accessors that have an unusually awkward API. Replaced with namespaceUri(String? prefix, String? uri) and namespaceUris(Map<String, String> prefixToUri) with a clear prefix-uri order.

... (truncated)

Commits

• fc47f1c Ready for 7.1.0
• 6903616 Add command-line XPath evaluation example tool
• 34d51d2 Update documentation, verify examples, and adhere to Dartdoc conventions
• 52bff18 [XPath] Close coverage gaps across path, predicate, operator, and sequence op...
• 7544f43 [XPath] Optimize path evaluation, step collapsing, and sequence atomization
• 1c779b5 [XPath] Enhance regex back-reference handling and XPath function argument val...
• 37c428c [XPath] Implement PetitParser-based regex transformer and push QT3 pass rate ...
• 168c1e1 [XPath] Improve XPath test coverage further
• 24ba23b [XPath] Expand XPath and XML events test suites to close coverage gaps
• 2000f67 [XPath] Remove unused operators and dead sequence caching code
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[atomicdeploy]

Complete manifest/lock diff, release notes and paginated conversation reviewed. Original commits normally merged into PR #24. Locked dependencies restored successfully. Adapted to actual archive4 rawContent.getStream(decompress:false)/CompressionType.deflate while retaining bounded inflation, declared-size and CRC guards; updated XML7 namespaceUri APIs. Full post-update native/mobile verification is in progress. No production device/app was modified.