dependency-hygienelisted

Enforces pubspec/lock discipline — caret ranges in pubspec.yaml with a committed pubspec.lock as the only pin, a separately-recorded SDK version string, a version-pinned very_good_analysis include (whose missing file fails default analyze, or silently drops the ruleset where warnings are non-fatal), transitive-tree auditing before adding a package, a dependency gate that refuses network/telemetry/crash/ads/heavy-transitive deps by policy, and vendoring any bus-factor-1 native plugin behind an interface into third_party/. Use when running dart pub add/get/upgrade/outdated/deps, editing pubspec.yaml or pubspec.lock, bumping the Flutter/Dart SDK, choosing or rejecting a new dependency, removing a package, or auditing what a dependency drags in.
zakariaf/CatchLaw · ★ 0 · AI & Automation · score 55

Install: claude install-skill zakariaf/CatchLaw

# Dependency hygiene Every dependency is a permanent liability someone else may have to service. Optimise for *resolves and builds years from now*, not for *latest*. This skill governs pubspec/lock mechanics, the gate a new package must pass, and the escape hatch when a critical package rots. Read the reference for the task at hand: - `references/dependency-gate-and-audit.md` — the refuse/accept gate, transitive auditing, licence recording, upgrade discipline. - `references/sdk-pin-and-lint-include.md` — recording the SDK version and the silent-lint-disable trap on any SDK bump. - `references/vendoring-behind-an-interface.md` — vendoring a bus-factor-1 native plugin into `third_party/` without touching `lib/`. Run `scripts/audit-deps.sh` before a PR that changes `pubspec.yaml`. ## Non-negotiable rules 1. **Caret ranges in `pubspec.yaml`, exact pins only in `pubspec.lock`.** `drift: ^2.31.0`, never `drift: 2.31.0`. The lock pins; ranges only keep resolution solvable. Exact pins in a pubspec manufacture unsolvable conflicts on the next SDK bump and buy nothing the lock is not already delivering. 2. **Commit `pubspec.lock`.** This is an application, not a package — the asymmetry that flips the rule. The default Dart `.gitignore` template lists `pubspec.lock`; delete that line. The committed lock is the only thing that makes a stranger's `git clone` resolve the exact versions that were tested on a real device. 3. **A `pubspec.yaml` diff without its `pubspec.lock` delta is in