lockvet v0.3.14

pub.dev joins the registry lineup — full metadata for Dart & Flutter

deps.dev has no Pub system, so until now pubspec.lock diffs had OSV
vulnerability data but no release metadata at all. Like Packagist for
PHP and hex.pm for the BEAM world, pub.dev itself now is the metadata
layer (one anonymous GET per changed package to its CORS-open packages
API — the browser playground
uses the identical route):

• Release ages + the ⏱ cooldown flag from each version's publish
  timestamp — -fail-on fresh now gates Dart bumps too.
• Discontinued packages land in the deprecation lane with the
  publisher's named replacement:
  ● deprecated upstream: discontinued on pub.dev; replaced by flutter_markdown_plus
  (live catches: flutter_markdown, js, the retired macros
  experiment). Retracted versions — ones dart pub refuses to newly
  resolve — flag the same way (live: dio 5.8.0, riverpod 2.3.9).
  -fail-on deprecated gates both.
• Registry-verified unlisted detection (▲): pub.dev never deletes a
  version outside moderation takedowns — retraction keeps it listed — so
  a version missing while its siblings are listed is real signal.
• Verified changelog/compare links: the upstream repo comes from the
  package's pubspec; monorepo /tree/… paths reduce to the repo, and
  Flutter-monorepo tags like shared_preferences_android-v2.4.6 resolve
  to exact tag-to-tag diffs.
• Git / path / SDK / private-host packages are marked NonRegistry —
  forked plugins pinned from GitHub (AppFlowy pins permission_handler
  that way) are exempt instead of raising phantom flags.

Fixed: + build metadata ordered wrong (Dart +N, Debian +dfsg-N)

0.5.1+10 → 0.5.1+11 was rendered as a DOWNGRADE in every previous
release: semver's spec ignores build metadata, so the two parsed equal
and fell into the downgrade branch. Registries that put + in lockfiles
order it — Dart numerically, Debian repacks by revision — and lockvet now
does too: +N bumps classify as the patch-level upgrades they are.

Full changelog: https://github.com/matteo-sung/lockvet/blob/main/CHANGELOG.md