dartvulncheck 0.3.0

Checks pubspec.lock and the Flutter/Dart SDK you build with against known vulnerabilities, and fails CI when it finds one.

0.3.0

• Each run asks pub.dev for the latest release of dartvulncheck and warns on stderr when a newer one exists. Upgrade with the same install command and the new version. A failed lookup never changes the output or the exit code; --verbose says why it was skipped.

0.2.3

• The install lines in the README and the example name the current version; 0.2.2 still showed 0.2.1. A test now keeps them in step with the version.
• The threat model and a code comment gave a wrong reason for not following redirects. No change to the tool.

0.2.2

• Published to pub.dev by the Publish to pub.dev workflow from the v<version> tag. No change to the tool.

0.2.1

• First version on pub.dev: dart pub global activate dartvulncheck.
• docs/ is now doc/, as the pub package layout expects; the threat model is at doc/threat-model.md.
• An example/ with the CI job and the command lines.

0.2.0

• Endpoint overrides (DARTVULNCHECK_*_URL) must be https; http is accepted for localhost only. Every override in effect is reported on stderr.
• Redirects are no longer followed, and page links are followed only within the configured API origin, so GITHUB_TOKEN is never sent elsewhere.
• Pagination stops after 50 pages, and a response is read with a 16 MiB cap.
• A repository's advisories apply only to the packages pub.dev maps to that repository, not to every locked package they name.
• On Windows, flutter and dart are started from their PATH location, never from the project directory.
• The SDK version from .fvmrc or --sdk-version is compared with flutter on PATH, and a difference is warned about.
• Packages from a registry other than pub.dev are warned about on every run; --verbose prints only the registry's host.
• The text report lists ignored findings under Ignored.
• docs/threat-model.md: a STRIDE review of the tool itself.

0.1.0

• First version.
• Checks hosted packages in pubspec.lock against the GitHub Advisory Database, with OSV.dev as a fallback when GitHub is unreachable.
• Checks repository security advisories of each package's GitHub repository (needs GITHUB_TOKEN), to catch issues before GitHub reviews them.
• Checks the Flutter / Dart SDK version against advisories in dart-lang/sdk and flutter/flutter.
• Honours ignored_advisories in pubspec.yaml.
• Text and --json output; exit codes 0 / 1 / 3.