dartvulncheck library
Checks pubspec.lock and the Flutter/Dart SDK against known vulnerabilities.
Use Runner for the command-line behaviour, or the lower layers directly: readLockfile → an AdvisorySource → matchPackages / matchSdk → renderText / renderJson. Checker wires them together.
Classes
- Advisory
- AdvisorySource
- AffectedPackage
- CheckedProject
- Checker
- CheckOptions
- CheckResult
- Command
- DartVersionUnknown
- EndpointOverridden
- Endpoints
- ExitCodes
- FailedProject
- FallbackSource
- FellBackToOsv
- Finding
- FlutterVersionUnreadable
- FvmConfigUnreadable
- GitHubClient
- GitHubGlobalSource
- HostedOutsidePubDev
- HttpFetcher
- InvalidVersion
- Lockfile
- LookupFailed
- LookupNote
- NewerRelease
- NewerReleaseAvailable
- NoGitHubRepository
- NoGitHubToken
- NotHosted
- OsvSource
- PackageCounts
- PackageRef
- ProcessOutput
- ProcessRunner
- ProjectResult
- PubDevClient
- RangeClause
- ReleaseCheck
- ReleaseStatus
- ReleaseUnknown
- RepositoryAdvisoryFetcher
- RepositoryLookupsFailed
- RepositoryPackageSource
- RepositoryResult
- RepositoryUnreadable
- RunCheck
- Runner
- SdkAdvisorySource
- SdkCheck
- SdkChecked
- SdkDetection
- SdkDetector
- SdkFailed
- SdkInfo
- SdkNotChecked
- SdkNotDetected
- SdkNotFound
- SdkStatus
- SdkVersionMismatch
- SdkVersionOverrideInvalid
- ShowHelp
- ShowVersion
- SkippedPackage
- Summary
- SystemProcessRunner
- ThirdPartyHostedChecked
- UpToDate
- VulnerableRange
- Warning
Constants
- jsonFormatVersion → const int
- packageVersion → const String
Functions
-
decodeJson(
Response response, String sourceName) → Object? -
describeNote(
LookupNote n) → String -
describeReleaseUnknown(
ReleaseUnknown s) → String -
describeWarning(
Warning w) → String -
exitCodeFor(
CheckResult result, {required Severity failOn, required bool strict}) → int -
findingFails(
Finding f, {required Severity failOn, required bool strict}) → bool -
findingToJson(
Finding f) → Map< String, Object?> -
findOnPath(
String executable, {required String path, required String pathExt, required bool exists(String file), Context? context}) → String? -
githubAffected(
Map< Object?, Object?> v, {required Object? patched}) → AffectedPackage -
githubAliases(
Map< Object?, Object?> json, String id) → List<String> -
githubRepoFromUrl(
String url) → String? -
hasDartAdvisories(
List< Advisory> advisories) → bool -
mapPool<
T, R> (List< T> items, int concurrency, Future<R> action(T)) → Future<List< R> > -
matchPackages(
List< PackageRef> packages, List<Advisory> advisories, {Set<String> ignored = const {}}) → List<Finding> -
matchSdk(
SdkInfo sdk, List< Advisory> advisories, {bool includeFlutter = true, Set<String> ignored = const {}}) → List<Finding> -
parseLockfile(
String content, {required String path}) → Lockfile -
parsePatchedVersions(
String? text) → List< Version> -
parseVulnerableRange(
String text) → VulnerableRange? -
readIgnoredAdvisories(
String path) → Set< String> -
readLockfile(
String path) → Lockfile -
renderJson(
CheckResult result) → String -
renderText(
CheckResult result) → String -
renderVerbose(
CheckResult result) → String -
sdkOriginLabel(
SdkOrigin origin) → String -
sdkSubject(
AffectedPackage e, String? repository) → String? -
sortFindings(
Iterable< Finding> findings) → List<Finding>