dart pub get --pristine/--locked

[jonasfj]

It would be nice to have a mode where dart pub get fails if pubspec.lock is missing or changes to pubspec.lock is required to satisfy pubspec.yaml.

Could be called dart pub get --locked or dart pub get --pristine.

Motivation: When doing a production build (or deployment) you explicitly want to avoid any deviation from pubspec.lock as this could result in shipping dependencies you have not tested.

[adarsh-technocrat]

Hello, @jonasfj 👋 I want to go ahead and work on this issue would you please give me the initial steps to get started with :)

[jonasfj]

@adarsh-technocrat, I would suggest figuring out how to run tests locally, and then experiment, it probably just means:

• Adding an option to dart pub get
• Passing a new pristine argument to acquireDependencies
• Figuring out all the adverse effects this could have, elsewhere in the code, if any :D
• Writing a lot of tests to show that --pristine works, both positive and negative tests.

[adarsh-technocrat]

@adarsh-technocrat, I would suggest figuring out how to run tests locally, and then experiment, it probably just means:

• Adding an option to dart pub get
• Passing a new pristine argument to acquireDependencies
• Figuring out all the adverse effects this could have, elsewhere in the code, if any :D
• Writing a lot of tests to show that --pristine works, both positive and negative tests.

Thanks, @jonasfj for guiding I'll look into it..:p

[yjbanov]

I don't think adding an extra option to pub get will work in practice. People type pub get (and flutter packages get) by hand on the command-line, and they won't use this option. I think a better approach is to add this option to pubspec.yaml and have pub get pick it up from there. Then we don't have to rely on humans remembering to use this option.

[jonasfj]

I don't think adding an extra option to pub get will work in practice. People type pub get (and flutter packages get) by hand on the command-line, and they won't use this option.

Just to be clear:

• pub get only modifies pubspec.lock if there is not other way to satisfy pubspec.yaml.
• The alternative to modifying pubspec.lock is failing.

@yjbanov When would people prefer to to fail, rather than just get their dependencies?

---

I envision that failing rather than modifying pubspec.lock is very attractive when deploying an application.
Because if your pubspec.yaml isn't satisfied by pubspec.lock then it's very likely that you didn't run test / QA with the same dependencies that you're deploying with.

But when doing local development, if I'm adding a dependency to pubspec.yaml then I just want dart pub get to update pubspec.lock as necessary. If I regret it, I can easily recover from git.

[sigurdm]

This was not completed in #3482, but separated to a later PR.