PR Health

// Copyright (c) 2025, the Dart project authors. Please see the AUTHORS file
// for details. All rights reserved. Use of this source code is governed by a
// BSD-style license that can be found in the LICENSE file.

@mosuem The breaking change check seems to fail on a dev path dependency.

Because code_assets depends on repo_lint_rules from path which doesn't exist (could not find package repo_lint_rules at "../repo_lint_rules"), version solving failed.
Error: Exception: Because code_assets depends on repo_lint_rules from path which doesn't exist (could not find package repo_lint_rules at "../repo_lint_rules"), version solving failed.

@mosuem The breaking change check seems to fail on a dev path dependency.

Because code_assets depends on repo_lint_rules from path which doesn't exist (could not find package repo_lint_rules at "../repo_lint_rules"), version solving failed.
Error: Exception: Because code_assets depends on repo_lint_rules from path which doesn't exist (could not find package repo_lint_rules at "../repo_lint_rules"), version solving failed.

That's WAI - published packages should not have path dependencies. If needed, use dependency overrides.

@mosuem The breaking change check seems to fail on a dev path dependency.

Because code_assets depends on repo_lint_rules from path which doesn't exist (could not find package repo_lint_rules at "../repo_lint_rules"), version solving failed.
Error: Exception: Because code_assets depends on repo_lint_rules from path which doesn't exist (could not find package repo_lint_rules at "../repo_lint_rules"), version solving failed.

That's WAI - published packages should not have path dependencies. If needed, use dependency overrides.

Dev dependencies can be path dependencies, right?

I think a user should be able to download a package and run pub get without any errors. A path dev deps does not break a package usage, but restricts to "just" package usage. That does feel a bit wrong, and can lead to errors such as this one.

I think a user should be able to download a package and run pub get without any errors. A path dev deps does not break a package usage, but restricts to "just" package usage. That does feel a bit wrong, and can lead to errors such as this one.

I don't believe this is true. If you "download" a package via git, you'll have all the other packages. If you "download" a package with pub get, you should not be doing pub get in the pub cache: you're not supposed to modify the pub cache. If you download the sources from a GitHub release, you have all the other packages. Why should a package be downloadable by itself? What use case is that for?

Why should a package be downloadable by itself? What use case is that for?

For example the API breakage check failing in this PR ;) Where we want to check if the current API is breaking compared to the old API. For this, we need to download the latest version of a package from pub, and compare it to the version in this PR. But if the one on pub is incomplete, this doesn't work anymore.

I could imagine other scenarios where people use pub.dev to download older versions. I think a package should be self-contained that way. Hosting on GitHub is an implementation detail, which I think we should not rely on.

Why should a package be downloadable by itself? What use case is that for?

For example the API breakage check failing in this PR ;) Where we want to check if the current API is breaking compared to the old API. For this, we need to download the latest version of a package from pub, and compare it to the version in this PR. But if the one on pub is incomplete, this doesn't work anymore.

I could imagine other scenarios where people use pub.dev to download older versions. I think a package should be self-contained that way. Hosting on GitHub is an implementation detail, which I think we should not rely on.

Hm, I think instead you need a dart pub get --no-dev-dependencies for this use case. I don't think you should be forced to publish code that is just used in tool/ or in the analysis_options.

I really don't want to publish pkgs/lints_only_for_this_repo!

Hmm, dart pub get --no-dev-dependencies sounds like a weird state to leave a package in, where some dependencies are resolved and other are not. It wouldn't even guarantee that the dependencies used in lib/ are resolved, just make it more likely.

I think if you publish a package, you should publish all it's dependencies. You can make them unlisted on pub if you want to. Or make them a git dependency or such - just don't hide it.

@jonasfj any thoughts?

It wouldn't even guarantee that the dependencies used in lib/ are resolved, just make it more likely.

Well, that would break your package when when published and used in another package! We should actually add this as a health check: dart pub get --no-dev-dependencies && dart analyze lib/.

That is indeed breaking, but should be covered by the depend_on_referenced_packages lint.