Dart pub
dart.dev
What it is
Dart pub is Dart’s package manager for finding and managing shared libraries and tools. It resolves dependency versions compatible with one another and the installed Dart SDK, and records selected versions in a lockfile so application teams can keep dependency versions consistent. Packages may come from pub.dev, other hosted repositories, Git repositories, local paths, or supported SDKs. Developers can use pub through the dart or Flutter command-line tools, and most Dart-savvy IDEs support package workflows. The `dart pub publish` command uploads packages to pub.dev. Before publishing, pub checks for possible secret leaks using limited patterns and may warn or refuse publication; packages published to pub.dev cannot have Git or local path dependencies in their pubspec. Security advisories draw on the GitHub Advisory Database for Dart and Flutter packages. Pub can often resolve dependencies offline from its shared cache. It supports Windows, Linux, and macOS, and is free and open source.
Spec sheet
- Purpose
- Pub is Dart’s package manager for managing package dependencies.Read 7 Oct 2026 · dart.dev
- Free plan
- YesRead 21 Sep 2026 · dart.dev
- Automated publishing
- After publishing a package’s first version, publishers can configure automated publishing through GitHub Actions or Google Cloud service accounts.Read 7 Oct 2026 · dart.dev
- Command line
- Pub can be used from the command line with the `dart pub` tool.Read 7 Oct 2026 · dart.dev
- Command line and IDEs
- Pub can be used through the dart or Flutter command-line tools, and most Dart-savvy IDEs support package workflows.Read 28 Sep 2026 · dart.dev
- Dependency management
- Pub resolves package versions that work together and with the installed Dart SDK.Read 28 Sep 2026 · dart.dev
- Dependency resolution
- Pub manages dependency versions to find versions compatible with each other and with the Dart SDK version.Read 7 Oct 2026 · dart.dev
- IDE support
- The page says most Dart-savvy IDEs support creating, downloading, updating, and publishing packages.Read 7 Oct 2026 · dart.dev
- Lockfile support
- YesRead 21 Sep 2026 · dart.dev
- Lockfiles
- Pub creates a `pubspec.lock` file listing the specific versions of a package’s direct and transitive dependencies.Read 7 Oct 2026 · dart.dev
- Offline installation
- YesRead 21 Sep 2026 · dart.dev
- Offline use
- Pub can often resolve dependencies offline from packages already stored in its shared system cache.Read 28 Sep 2026 · dart.dev
- Package formats
- Dart packagesRead 21 Sep 2026 · dart.dev
- Package integrity
- Pub uses SHA256 content hashes maintained by pub.dev to validate package integrity.Read 7 Oct 2026 · dart.dev
- Package sources
- Packages can come from pub.dev, the local file system, or other locations such as Git repositories.Read 7 Oct 2026 · dart.dev
- Private registry auth
- YesRead 21 Sep 2026 · dart.dev
- Production installs
- The `dart pub get --enforce-lockfile` command fails if dependency constraints cannot be satisfied with the exact locked versions and content hashes.Read 7 Oct 2026 · dart.dev
- Publication permanence
- Published packages generally cannot be unpublished, though publishers can upload new versions and mark packages as discontinued.Read 7 Oct 2026 · dart.dev
- Publisher verification
- pub.dev verifies verified-publisher identities through domain ownership checks using Google Search Console logic.Read 28 Sep 2026 · dart.dev
- Publishing
- The `dart pub publish` command validates a package and uploads it to pub.dev.Read 7 Oct 2026 · dart.dev
- Publishing limit
- Packages published to pub.dev cannot have Git or local path dependencies in their pubspec.Read 28 Sep 2026 · dart.dev
- Publishing limits
- The publishing guide recommends package sizes below 100 MB compressed and 256 MB uncompressed.Read 7 Oct 2026 · dart.dev
- SDK platforms
- The Dart SDK system requirements list Windows, Linux, and macOS.Read 7 Oct 2026 · dart.dev
- Secret detection
- Before publishing, pub checks for potential secret leaks using limited patterns and warns or refuses publication when it detects a possible leak.Read 28 Sep 2026 · dart.dev
- Security advisories
- Pub uses the GitHub Advisory Database for security advisories affecting Dart and Flutter packages.Read 28 Sep 2026 · dart.dev
- Security reporting
- The pub.dev security page directs users to report pub.dev vulnerabilities through a Google contact form and package vulnerabilities through GitHub Security Advisories.Read 7 Oct 2026 · pub.dev
- Supported platforms
- Windows,Linux,macOSRead 21 Sep 2026 · dart.dev
- Version consistency
- Pub records selected dependency versions in a lockfile so application teams can use the same versions.Read 28 Sep 2026 · dart.dev
- Workspace support
- YesRead 21 Sep 2026 · dart.dev
Strong points and limits
Strong points
- Resolves dependencies against the installed Dart SDK
- Records exact dependency versions in a lockfile
- Can resolve dependencies offline from shared cache
- Free and open source
Limits
- Published packages cannot depend on Git or local paths
- Secret checks use limited patterns
Who it suits
It suits Dart developers managing dependencies for applications or publishing packages to pub.dev. Teams needing consistent dependency versions can use its lockfile workflow.
Verdict
Pub provides dependency resolution, lockfiles, and publishing workflows centered on Dart packages. Its offline support and IDE integration add options beyond command-line use.
Where Specifiction places it
- Package Managers#46 of 937.8
- Code Transpilers#17 of 287.7
