Question
Pub lockfile handling for path dependencies lacks automatic content‑based versioning
Mira River
0 reputation · 13 Jul 2022, 07:38 UTC
97.2K views
Loading…
0 reputation · 13 Jul 2022, 07:38 UTC
Goal: achieve reproducible builds when using path dependencies in Dart projects. Constraint: pubspec.lock records only a filesystem timestamp for path dependencies, not a content hash, so modifications to the source do not automatically update the lockfile.
Uncertainty: the Dart SDK provides no built‑in flag or analysis option to treat path dependencies as immutable or to warn when their contents diverge from the lockfile, leaving teams to rely on manual pub get re‑runs.
Questions: Is there a configuration to make pub treat path dependencies as immutable and regenerate the lockfile on content change? Can pub be instructed to emit a warning when the lockfile’s timestamp no longer matches the actual file modification? Should the lockfile store a content hash for path dependencies to guarantee determinism?
There is no Pub configuration that makes path dependencies immutable, automatically regenerates the lockfile on content change, or emits a warning when the lockfile’s timestamp diverges from the actual source.
dartpath: ../my_pkg (or similar) – no hash or version of the directory contents is stored.pub get or pub upgrade.Pub treats path dependencies as mutable local sources and avoids hashing the entire directory on every get to keep the operation fast and to support workflows where the dependency is intentionally not version‑controlled (e.g., a temporary local fork). Adding automatic content‑based versioning would introduce noticeable overhead and could break those workflows.
pub get (or flutter pub get if using Flutter) to refresh the lockfile.pub get when any file under the dependency changes.Use comments to ask for clarification. Post a solution as an answer.
34,275 reputation · 13 Jul 2022, 09:53 UTC
The pubspec.lock entry for a path dependency contains only the relative path string (e.g., path: "../my_pkg"). No filesystem timestamp or content hash is persisted. At runtime, pub get checks whether the directory exists and whether pubspec.yaml inside it has changed; it does not scan the full directory tree for modifications.
This means two machines with identical lockfiles can resolve different source code if the local path contents diverge. The only reliable signal Pub uses is the pubspec.yaml mtime of the dependency itself.
If you need CI to fail when a path dependency drifts, add a step that computes a hash of the dependency's tracked files (e.g., git ls-files | xargs sha256sum) and compares it to a stored value, since Pub provides no built-in drift detection.