skills.rest
zakariaf
zakariafCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

dependency-hygiene

Audits Dart and Flutter dependency trees against policy bans and enforces pubspec lock discipline.

Updated Aug 22, 2026
Search Tags:#flutter#dependency audit#dart#pubspec#sdk pinning#vendoring#transitive dependencies
One-click install
npx skills add https://github.com/zakariaf/NearlyStop --skill dependency-hygiene-zakariaf
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependency-hygiene
Source: https://github.com/zakariaf/NearlyStop/tree/main/.claude/skills/dependency-hygiene
Command: npx skills add https://github.com/zakariaf/NearlyStop --skill dependency-hygiene-zakariaf

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Flutter and Dart projects accumulate dependencies that silently pull in network clients, telemetry SDKs, or abandoned packages, and a gitignored or stale pubspec.lock means every machine resolves a different graph. This Skill enforces a repeatable discipline so a project still resolves and builds years later. ## Core Features & Use Cases - Policy-based transitive auditing: Walks the full resolved dependency graph via dart pub deps --json and flags banned packages (network clients, crash reporting, analytics, ads, device identifiers) whether they arrive directly or transitively, separating shipping deps from build/test-only ones. - Pubspec and lock discipline: Enforces caret ranges in pubspec.yaml with exact pins only in a committed pubspec.lock, and verifies the version-pinned lint include file still exists after an SDK bump. - Vendoring escape hatch: Provides a procedure for wrapping a bus-factor-1 native plugin behind an interface and vendoring it into third_party/ only when it actually breaks. - Use Case: Before adding a new package to an offline-first Flutter app, run the audit script to discover that the package transitively pulls in a telemetry core, then reject it before it ever reaches pubspec.yaml. ## Quick Start Ask the assistant to audit the project's dependencies by running scripts/audit-deps.sh and report any banned packages in the resolved tree.

Frequently Asked Questions about dependency-hygiene

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Flutter dependencies for banned packages?▼

Run dart pub deps --json and pipe the output to the audit_deps.py script, which walks the full resolved tree and flags packages matching banned patterns like http, dio, sentry, or firebase. Exit code 1 means a banned package ships in the binary.

Should pubspec.lock be committed for a Flutter app?▼

Yes, an application must commit pubspec.lock because it is the only record of the exact versions that were tested. The default Dart .gitignore template lists pubspec.lock, so delete that line; packages gitignore it, apps must not.

Why does my lint ruleset stop applying after a Flutter SDK upgrade?▼

A version-pinned include like analysis_options.6.0.0.yaml may not exist in the newly resolved very_good_analysis version, emitting include_file_not_found. Where warnings are non-fatal this silently drops your ruleset's added rules; verify the include file exists in the resolved package after every SDK bump.

What is the difference between caret ranges and exact pins in pubspec.yaml?▼

Caret ranges like drift: ^2.31.0 keep the solver able to resolve on SDK upgrades, while exact pins manufacture unsolvable conflicts. The committed pubspec.lock already provides the exact pinning, so pins in pubspec.yaml buy nothing.

When should I vendor a Flutter plugin into third_party?▼

Vendor only when a bus-factor-1 plugin stops building against a new Flutter release or ships a regression upstream will not fix. Wrap it behind an interface on day one as cheap insurance, then clone at the last-good tag, record the SHA in VENDORED.md, and patch rather than refactor.

Does the dependency audit flag packages only used in dev_dependencies?▼

No, the audit separates APK-shipping dependencies reachable from dependencies: from build/test-only ones reachable only via dev_dependencies. A banned package reachable only through dev tooling, like a codegen watch-mode HTTP server, never reaches the binary and is reported as informational, not a defect.

Related Skills

Explore More Software Engineering Skills→
zakariafzakariaf

shed-dependencies-and-toolchain

Validates Flutter dependency pins and toolchain versions against a decision record before pubspec changes.

Community
Advanced
ChegginCheggin
1

dependency-manager

Automate npm audits, update PRs, and lockfile validation for Node.js projects.

Community
Advanced
zakariafzakariaf

codegen-and-toolchain

Enforces deterministic build_runner codegen ordering, scoping, and commit policy for Dart projects.

Community
Advanced
dart-langdart-lang
428

dart-resolve-package-conflicts

Resolve Dart pub version conflicts using dart pub outdated and upgrade.

Official
Intermediate