pubreg

Documentation

Overview

Package pubreg asks pub.dev what it knows about the Dart/Flutter packages a diff touches (pubspec.lock resolves against pub.dev). deps.dev has no Pub system at all, so for the Dart world this package IS the metadata layer, not a fallback:

• Release ages and the ⏱ cooldown flag, from each version's published timestamp.
• Discontinued packages (pub.dev's package-level deprecation) land in the deprecation lane, with the replacement package when the publisher named one ("discontinued; replaced by lints").
• Retracted versions (pub.dev's per-version recall, `dart pub` refuses to newly resolve them) land in the deprecation lane too.
• Unlisted detection: pub.dev never deletes versions except through moderation of malicious/legal takedowns — retraction keeps the version listed — so an incoming version missing while the package's other versions ARE listed is a strong signal. Packages pub.dev does not know at all are never flagged, and the parser marks git/path/sdk/private-host installs NonRegistry besides.
• The upstream source repository from the package's pubspec (monorepo /tree/... paths reduced to the repo), which the changelog layers turn into verified compare links and release notes.

pub.dev has no per-release license history, so license-change detection is honestly left out for this ecosystem.

One anonymous GET per changed package against the CORS-open pub.dev/api/packages endpoint — the same route works native and in the browser (wasm) build.

Index

• Variables
• func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

Variables

var BaseURL = "https://pub.dev"

BaseURL is the pub.dev API base; a var so tests can fake it.

var Now = time.Now

Now is a var so tests can pin the clock.

Functions

func Annotate

func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

Annotate fills pub.dev metadata on the diffs; see the package comment for what it covers. The returned bool reports whether at least one package was actually vetted against pub.dev (callers use it to decide whether release metadata was checked at all, since deps.dev never covers Pub). freshDays mirrors -fresh-days. Best-effort: per-package failures skip that package; only total failure returns an error.