pubspec.lock is the file where Dart's pub tool records the exact version of each dependency it resolved from the ranges in pubspec.yaml. Ranges say what is allowed, the lockfile says what you got. For vulnerability checks, read the lockfile, and watch for dependency overrides that bypass the declared ranges.
Ranges versus resolved versions
The Dart documentation shows a dependency written as transmogrify: ^1.0.0. That creates a dependency using the default repository, pub.dev, and allows any version from 1.0.0 up to but not including 2.0.0. The docs recommend caret syntax because it lets pub choose newer versions as they appear while keeping an upper bound.
Two commands change what the lockfile holds. Running dart pub get or dart pub upgrade updates the lockfile. Upgrade moves to the latest versions the pubspec allows. The docs also mention dart pub outdated to see which dependencies are not on the latest stable versions.
So a project declaring ^1.0.0 may have 1.0.2 locked today and 1.4.0 after an upgrade. An advisory affecting 1.0.0 to 1.2.0 applies in the first case and not the second.
Overrides can change the answer
The same page describes dependency_overrides, which tells pub to use a particular source or version regardless of what the other packages ask for. An override can point at a local path or force a version number. The docs carry a warning that using an override involves risk, for example forcing a version outside the range a package supports.
For security this cuts both ways. An override can force a fixed version of a vulnerable transitive package, which is useful. But a stale override can also pin a vulnerable version after the rest of the tree has moved on, and it will not show up in the ranges of any package that depends on it.
| Item in pubspec.yaml | What it means for the lockfile |
|---|---|
| A caret range | Resolved to some version inside the range |
| A path source | Resolved to local code, with no registry version to match |
| An override with a version | That version is used regardless of other ranges |
Content hashes and verifying downloads
The docs describe a flag, --enforce-lockfile, for retrieving new dependencies. They state it resolves new dependencies only if pubspec.yaml is satisfied, pubspec.lock is not missing, and the packages' content hashes match. The hashes are SHA256 values maintained by pub.dev to validate package integrity.
That is an integrity check, not a vulnerability check. It tells you the package you downloaded is the one the lockfile describes. It says nothing about whether that version has known advisories.
Steps to review a Dart project
- Keep pubspec.lock in version control for applications, as a committed lock gives every build the same versions (check Dart's current guidance for libraries).
- Run
dart pub outdatedto see how far behind you are. - Search pubspec.yaml for dependency_overrides and check each one still has a reason.
- Scan from the lockfile, not the ranges.
- For path dependencies, scan the code in that path as part of your own source.
Safeguard's SBOM and dependency scanning builds an inventory for your projects. Try the free scan on a repository to see what is listed.
Quick check
Does pubspec.lock say whether a version is vulnerable?
No. It records versions and hashes. You compare those versions to advisory data separately.
What is dependency_overrides for?
It makes pub use a chosen source or version regardless of what packages ask for. The docs warn it carries risk.
Sources
Last reviewed: 19 October 2026.
