[rootstift]

✨ What kind of change does this PR introduce? (Bug fix, feature, docs update...)

A fork sync. It merges upstream Baseflow/flutter_cached_network_image tag v4.0.6 (5387cfa, which is also upstream main) into the fork's main. The merge is clean, with no conflicts, and all three Stift patches are kept.

Upstream's release commits are in the range, so the packages move to the versions upstream published: cached_network_image 4.0.6, cached_network_image_web 2.0.4. cached_network_image_platform_interface stays at 5.0.3. Every CHANGELOG.md and version: line in the diff is upstream's. This PR adds none of its own, which is why it touches two packages instead of one.

⤵️ What is the current behavior?

The fork is at upstream v4.0.5 plus Stift's web patches. It is missing two upstream fixes:

• a2a555b fix(web): report cached file read and decode failures on HttpGet (fix(web): report cached file read and decode failures on HttpGet Baseflow/flutter_cached_network_image#1063).
• 5387cfa fix: dispose the queued animation frame when the image completer is disposed (fix: dispose queued animation frame when image completer is disposed Baseflow/flutter_cached_network_image#1065).

🆕 What is the new behavior (if this is a feature change)?

Web (HttpGet, Stift's default), a2a555b:

• Failures reading or decoding a cached file are now reported to the image stream instead of being lost.
• The broken cache entry is removed (removeFile(cacheKey ?? url)), and evictImage is called, so a retry downloads again.
• Stift's ImageBitmap decode still runs on this path: _decodeBytes is the decode callback for both loadBufferAsync and loadImageAsync. decodeWithImageBitmap catches its own errors and falls back to the engine. Engine errors are the ones upstream now reports, at most once (guarded by settling / finished).

All platforms, 5387cfa: a frame that resolves after MultiImageStreamCompleter is disposed, or after its codec is swapped, is now disposed instead of leaked. Combined with Stift's _ImageBitmapCodec.dispose, which frees only images never handed out, each frame is freed exactly once.

Stift patch	Status
ad5dbdb feat(web): default ImageRenderMethodForWeb to HttpGet	kept
b485cd2 fix(web): decode images via ImageBitmap so they stop painting black on Firefox	kept
9b7114e style(web): format the ImageBitmap decode patch files	kept

After the merge, the fork's diff against v4.0.6 is exactly those patches: 8 files, +263/−11.

💥 Does this PR introduce a breaking change?

No.

🐛 Recommendations for testing

What ran in the fork:

• flutter analyze is clean in all three packages.
• flutter test: platform interface 1/1, app-facing 75/75, web 19/19 (--platform chrome, Chromium).

What ran against the Stift app: the three packages were pointed at this branch via a local path: (not committed), on app main 5a1da20, Flutter 3.47.8.

Check	app main	with this branch
flutter analyze (E/W/I)	771 / 83 / 489	identical, finding for finding
flutter test	+377 / −85	+377 / −85, identical failing set
flutter build web --release	✓ main.dart.js 23,718,926 B	✓ 23,720,572 B (+1.6 KB)

The app needs no code changes. It tracks this fork's main, so the app's next lock refresh picks this up.

What wasn't covered: the ImageBitmap path itself. On Chrome the engine already decodes with WebCodecs, so the web tests only exercise the engine fallback. Please check by hand on Firefox and Safari (Flutter web, HttpGet):

• Images render, not black, and stay after back-navigation.
• A 404 or non-image URL shows the error widget, and a retry downloads again.
• Images with auth httpHeaders load.

Known upstream behaviour, not introduced by Stift: if a stale cached file decodes but the fresh one that follows is broken, the stream finishes without error and the broken file stays cached until the next load fails once.

A self-review against the Stift app's .claude/skills/deps-update/review.md found architecture, security, performance and functionality all OK, with no blockers. Caller headers are still sent only to getFileStream, and the new removeFile deletes only that image's own entry.

📝 Links to relevant issues/docs

• Upstream: fix(web): report cached file read and decode failures on HttpGet Baseflow/flutter_cached_network_image#1063 and fix: dispose queued animation frame when image completer is disposed Baseflow/flutter_cached_network_image#1065, plus the v4.0.6 and web-v2.0.4 changelog entries in the diff.
• Previous sync: chore(sync): merge upstream v4.0.5 #3 (v4.0.5).
• Dependency dashboard: StiftTechnologies/app#312.

🤔 Checklist before submitting

• All projects build
• Follows style guide lines (code style guide)
• Relevant documentation was updated
• Rebased onto current main

---

Generated by Claude Code

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8c265de9-2026-4374-bdb1-6ba6ad4396ad

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn