chore(deps)!: bump dep floors, widen plus-plugin majors, migrate file_picker 11

docs/docs_screenshots/pubspec.yaml

@@ -30,8 +30,8 @@ dev_dependencies:
   device_preview: ^1.2.0
   flutter_test:
     sdk: flutter
-  mocktail: ^1.0.0
-  plugin_platform_interface: ^2.0.0
+  mocktail: ^1.0.5
+  plugin_platform_interface: ^2.1.8
 
 flutter:
   uses-material-design: true

melos.yaml

@@ -30,64 +30,64 @@ command:
 
     # List of all the dependencies used in the project.
     dependencies:
-      async: ^2.11.0
+      async: ^2.13.1
       avatar_glow: ^3.0.0
-      cached_network_image: ^3.3.1
-      chewie: ^1.8.1
-      collection: ^1.17.2
-      connectivity_plus: ">=6.0.3 <8.0.0"
+      cached_network_image: ^3.4.1
+      chewie: ^1.13.1
+      collection: ^1.19.1
+      connectivity_plus: ">=7.1.1 <8.0.0"
       cupertino_icons: ^1.0.3
-      desktop_drop: '>=0.5.0 <0.8.0'
-      device_info_plus: '>=11.0.0 <13.0.0'
+      desktop_drop: '>=0.7.1 <0.8.0'
+      device_info_plus: '>=12.4.0 <14.0.0'
       device_preview: ^1.2.0
-      diacritic: ^0.1.5
-      dio: ^5.4.3+1
-      drift: ^2.28.0
-      equatable: ^2.0.5
+      diacritic: ^0.1.6
+      dio: ^5.9.2
+      drift: ^2.33.0
+      equatable: ^2.0.8
       ezanimation: ^0.6.0
       firebase_core: ^4.0.0
       firebase_messaging: ^16.0.0
-      file_picker: ^10.1.2
-      file_selector: ^1.0.3
+      file_picker: ^11.0.0
+      file_selector: ^1.1.0
       flutter_app_badger: ^1.5.0
       flutter_local_notifications: ^21.0.0
       flutter_map: ^8.1.1
       flutter_map_animations: ^0.9.0
-      flutter_markdown: ^0.7.2+1
+      flutter_markdown: ^0.7.7+1
       flutter_portal: ^1.1.4
       flutter_secure_storage: ^9.2.2
       flutter_slidable: ^3.1.1
-      flutter_svg: ^2.0.10+1
+      flutter_svg: ^2.3.0
       freezed_annotation: ">=2.4.1 <4.0.0"
-      gal: ^2.3.1
+      gal: ^2.3.2
       geolocator: ^13.0.0
       get_thumbnail_video: ^0.7.3
       go_router: ^14.6.2
-      http_parser: ^4.0.2
-      image_picker: ^1.1.2
-      image_size_getter: ^2.3.0
-      jiffy: ^6.2.1
-      jose: ^0.3.4
-      json_annotation: ^4.9.0
-      just_audio: ">=0.9.38 <0.11.0"
+      http_parser: ^4.1.2
+      image_picker: ^1.2.2
+      image_size_getter: ^2.4.1
+      jiffy: ^6.4.4
+      jose: ^0.3.5+1
+      json_annotation: ^4.11.0
+      just_audio: ">=0.10.5 <0.11.0"
       latlong2: ^0.9.1
-      logging: ^1.2.0
-      lottie: ^3.1.2
-      media_kit: ^1.2.2
-      media_kit_video: ^2.0.0
+      logging: ^1.3.0
+      lottie: ^3.3.3
+      media_kit: ^1.2.6
+      media_kit_video: ^2.0.1
       meta: ^1.9.1
       mime: ^2.0.0
-      package_info_plus: ">=8.3.0 <10.0.0"
-      path: ^1.8.3
-      path_provider: ^2.1.3
-      photo_manager: ^3.8.3
+      package_info_plus: ">=9.0.1 <11.0.0"
+      path: ^1.9.1
+      path_provider: ^2.1.5
+      photo_manager: ^3.9.0
       photo_view: ^0.15.0
       rate_limiter: ^1.0.0
       record: ^6.2.0
       responsive_builder: ^0.7.0
       rxdart: ^0.28.0
       sentry_flutter: ^8.3.0
-      share_plus: ">=11.0.0 <13.0.0"
+      share_plus: ">=12.0.2 <14.0.0"
       shimmer: ^3.0.0
       sqlite3_flutter_libs: ^0.5.26
       stream_chat: ^10.0.0-beta.13
@@ -103,30 +103,30 @@ command:
           url: https://github.com/GetStream/stream-core-flutter.git
           ref: da615a2b232948bf89e46ea3d4c2e99084420544
           path: packages/stream_core_flutter
-      synchronized: ^3.1.0+1
+      synchronized: ^3.4.0
       thumblr: ^0.0.4
-      url_launcher: ^6.3.0
-      uuid: ^4.4.0
-      video_player: ^2.8.7
-      web_socket_channel: ^3.0.1
+      url_launcher: ^6.3.2
+      uuid: ^4.5.3
+      video_player: ^2.11.1
+      web_socket_channel: ^3.0.3
 
     # List of all the dev_dependencies used in the project.
     dev_dependencies:
       alchemist: ^0.14.0
-      build_runner: ^2.4.9
-      connectivity_plus_platform_interface: ^2.0.0
-      drift_dev: ^2.28.0
-      fake_async: ^1.3.1
-      faker_dart: ^0.2.1
-      flutter_launcher_icons: ^0.14.2
+      build_runner: ^2.15.0
+      connectivity_plus_platform_interface: ^2.1.0
+      drift_dev: ^2.33.0
+      fake_async: ^1.3.3
+      faker_dart: ^0.2.3
+      flutter_launcher_icons: ^0.14.4
       freezed: ">=2.4.2 <4.0.0"
-      json_serializable: ^6.7.1
-      mocktail: ^1.0.0
-      path: ^1.8.3
-      path_provider_platform_interface: ^2.0.0
-      plugin_platform_interface: ^2.0.0
-      test: ^1.24.6
-      theme_extensions_builder: ^7.2.0
+      json_serializable: ^6.13.2
+      mocktail: ^1.0.5
+      path: ^1.9.1
+      path_provider_platform_interface: ^2.1.2
+      plugin_platform_interface: ^2.1.8
+      test: ^1.31.1
+      theme_extensions_builder: ^7.3.0
 
     hooks:
       # Updates the version.dart file after bootstrapping with the current version from pubspec.yaml

packages/stream_chat/CHANGELOG.md

@@ -12,9 +12,14 @@
 
 🔄 Changed
 
+- Raised minimum versions of bundled Dart dependencies (`async`, `collection`, `dio`, `equatable`, `http_parser`, `json_annotation`, `logging`, `synchronized`, `uuid`, `web_socket_channel`) to current resolved versions.
 - Tightened `Channel.isGroup` from `memberCount != 2` to `memberCount > 2 || !isDistinct`. Two-member non-distinct channels now correctly report as groups, and 1-member distinct channels no longer do. Migrate via `!channel.isOneToOne` or `channel.memberCount != 2`.
 - Tightened `Channel.isDistinct` to require the `!members-` prefix (with trailing dash), matching the backend's `DistinctChannelPrefix` constant. Real server-generated ids always include the dash; only malformed/test ids that previously matched the looser `!members` check are affected.
 
+🔒 Security
+
+- Bumped `jose` floor to `0.3.5+1` to address [CVE-2026-34240](https://github.com/advisories/GHSA-vm9r-h74p-hg97) (untrusted JWK header accepted during signature verification). The SDK only uses `JsonWebToken.unverified` and is not directly exploitable, but the floor bump ensures consumers resolve to a patched version.
+
 🐞 Fixed
 
 - Fixed reactions, polls, and quoted-message enrichment briefly flickering after the app returned from the background. The reconnect path now refreshes channels and advances `lastSyncAt` to the current time instead of replaying every event since `lastSyncAt` through `handleEvent`. `client.sync()` remains available for consumers that need event-level replay.