In my library, I use always_specify_types to be sure that the public functions and variables have a proper type, but now with omit_local_variable_types I have a lot of hints that I cannot correct as both rules contradict each other.

Problem

Workiva runs our own internal pub server due to IP concerns. Pana looks to have hard-coded the main pub server here: https://github.com/dart-lang/pana/blob/master/lib/src/download_utils.dart#L22

This means that we can't currently run it to analyze packages hosted on our internal server. I'd like to see a command-line parameter to specify the pub server to use.

On a related note: It should probably also handle sub dependencies declared in pubspec.yaml that are hosted on a different pub server.

Dart VM supports them, web platform does not.

We should either (a) allow it and disqualify web platform when its use is detected or (b) run two analysis (enabled/disabled), and if they differ, use the enabled one and disqualify web.

☁  pana [master] pub global run pana
INFO       Running `/Applications/Tools/dart-sdk/bin/dart --version`...
Unhandled exception:
Null check operator used on a null value
#0      new DartSdkInfo.parse (package:pana/src/sdk_env.dart:505:38)
#1      ToolEnvironment._init (package:pana/src/sdk_env.dart:87:37)
<asynchronous suspension>
#2      ToolEnvironment.create (package:pana/src/sdk_env.dart:160:5)
<asynchronous suspension>
#3      PackageAnalyzer.create (package:pana/src/package_analyzer.dart:60:28)
<asynchronous suspension>
#4      main (file:///Users/pquitslund/.pub-cache/hosted/pub.dartlang.org/pana-0.19.1/bin/pana.dart:134:22)
<asynchronous suspension>

Here's my SDK info:

☁  linter [master] dart --version
Dart SDK version: 2.15.0-edge.e8ddc0219f1e8f1ad784143fec693890e2b81954 (be) (Fri Aug 13 13:27:41 2021 +0000) on "macos_x64"

See also: https://github.com/dart-lang/linter/issues/2504

analyzer:
  strong-mode:
    implicit-casts: false

Suggestion from https://github.com/dart-lang/pub-dartlang-dart/issues/1263 and it was also detailed in https://github.com/flutter/flutter/issues/14921#issuecomment-369180365

/cc @jakobr-google, @kevmoo, @mraleph

Flutter for example tracks that all public members in flutter/flutter are documented.

flutter analyze --flutter-repo --dartdocs is the command we use.

Which just turns on: http://dart-lang.github.io/linter/lints/package_api_docs.html

Example: https://pub.dartlang.org/packages/angular_components/versions/0.9.0-alpha%2B2#-analysis-tab-

The uri_has_not_been_generated: ignore option I have in the analysis_options.yaml file is not being used. https://github.com/dart-lang/angular_components/blob/master/analysis_options.yaml#L8

Currently there's a hand-crafted list of enforced lints:

https://github.com/dart-lang/pana/blob/master/lib/src/analysis_options.dart

It would be cool to migrate to the pedantic package rule-set and be able to badge projects "pedantic" clean or something.

FWIW we're tagging pedantic and flutter user lints now in the generated docs like so:

(The flutter badge corresponds to lints in flutter user options.)

/cc @isoos @kevmoo @jonasfj

dart --checked bin/main.dart angular_ast 0.4.0-alpha+2

SEVERE     Error scanning direct librariers
           Stack Overflow
           #0      _HashMap.putIfAbsent (dart:collection-patch/dart:collection/collection_patch.dart:130)
           #1      CacheEntry.getResultData (package:analyzer/src/context/cache.dart:423:23)
           #2      CacheEntry._setErrorState (package:analyzer/src/context/cache.dart:800:27)
           #3      CacheEntry._setErrorState.<anonymous closure> (package:analyzer/src/context/cache.dart:813:17)
           #4      _HashFieldBase&_HashBase&_OperatorEqualsAndHashCode&SetMixin.forEach (dart:collection/set.dart:145)
           #5      CacheEntry._setErrorState (package:analyzer/src/context/cache.dart:808:31)
           #6      CacheEntry._setErrorState.<anonymous closure> (package:analyzer/src/context/cache.dart:813:17)
           #7      _HashFieldBase&_HashBase&_OperatorEqualsAndHashCode&SetMixin.forEach (dart:collection/set.dart:145)
           #8      CacheEntry._setErrorState (package:analyzer/src/context/cache.dart:808:31)
           #9      CacheEntry._setErrorState.<anonymous closure> (package:analyzer/src/context/cache.dart:813:17)
           #10     _HashFieldBase&_HashBase&_OperatorEqualsAndHashCode&SetMixin.forEach (dart:collection/set.dart:145)
           ...
           ...
           #13660  _RootZone.runUnary (dart:async/zone.dart:1379)
           #13661  _FutureListener.handleValue (dart:async/future_impl.dart:129)
           #13662  _Future._propagateToListeners.handleValueCallback (dart:async/future_impl.dart:635)
           #13663  _Future._propagateToListeners (dart:async/future_impl.dart:664)
           #13664  _Future._completeWithValue (dart:async/future_impl.dart:477)
           #13665  _Future._asyncComplete.<anonymous closure> (dart:async/future_impl.dart:509)
           #13666  _microtaskLoop (dart:async/schedule_microtask.dart:41)
           #13667  _startMicrotaskLoop (dart:async/schedule_microtask.dart:50)
           #13668  _runPendingImmediateCallback (dart:isolate-patch/dart:isolate/isolate_patch.dart:111)
           #13669  _RawReceivePortImpl._handleMessage (dart:isolate-patch/dart:isolate/isolate_patch.dart:164)
INFO       Scanning transitive dependencies...
SEVERE     Error scanning transitive librariers
           Stack Overflow
           #0      _HashMap.putIfAbsent (dart:collection-patch/dart:collection/collection_patch.dart:130)
           #1      CacheEntry._setErrorState (package:analyzer/src/context/cache.dart:423:23)
           #2      CacheEntry._setErrorState.<anonymous closure> (package:analyzer/src/context/cache.dart:813:17)
           #3      CacheEntry._setErrorState (package:analyzer/src/context/cache.dart)
           #4      CacheEntry._setErrorState.<anonymous closure> (package:analyzer/src/context/cache.dart:813:17)
           #5      CacheEntry._setErrorState (package:analyzer/src/context/cache.dart)
           #6      CacheEntry._setErrorState.<anonymous closure> (package:analyzer/src/context/cache.dart:813:17)
           #7      CacheEntry._setErrorState (package:analyzer/src/context/cache.dart)
           #8      CacheEntry._setErrorState.<anonymous closure> (package:analyzer/src/context/cache.dart:813:17)
           #9      CacheEntry._setErrorState (package:analyzer/src/context/cache.dart)
           #10     CacheEntry._setErrorState.<anonymous closure> (package:analyzer/src/context/cache.dart:813:17)
           #11     CacheEntry._setErrorState (package:analyzer/src/context/cache.dart)
           #12     CacheEntry._setErrorState.<anonymous closure> (package:analyzer/src/context/cache.dart:813:17)
           #13     CacheEntry._setErrorState (package:analyzer/src/context/cache.dart)
           ...
           ...
           #9053   _RootZone.runUnary (dart:async/zone.dart:1379)
           #9054   _FutureListener.handleValue (dart:async/future_impl.dart:129)
           #9055   _Future._propagateToListeners.handleValueCallback (dart:async/future_impl.dart:635)
           #9056   _Future._propagateToListeners (dart:async/future_impl.dart:664)
           #9057   _Future._completeWithValue (dart:async/future_impl.dart:477)
           #9058   _Future._asyncComplete.<anonymous closure> (dart:async/future_impl.dart:509)
           #9059   _microtaskLoop (dart:async/schedule_microtask.dart:41)
           #9060   _startMicrotaskLoop (dart:async/schedule_microtask.dart:50)
           #9061   _runPendingImmediateCallback (dart:isolate-patch/dart:isolate/isolate_patch.dart:111)
           #9062   _RawReceivePortImpl._handleMessage (dart:isolate-patch/dart:isolate/isolate_patch.dart:164)
INFO       Analyzing package...

As of the lastest pana release, the linter's maintenance score has dropped w/ this warning:

 "maintenance": {
  "missingChangelog": false,
  "missingExample": false,
  "missingReadme": false,
  "missingAnalysisOptions": false,
  "oldAnalysisOptions": false,
  "strongModeEnabled": true,
  "isExperimentalVersion": false,
  "isPreReleaseVersion": false,
  "suggestions": [
   {
    "code": "sdk.missing",
    "level": "error",
    "title": "No valid SDK.",
    "description": "The analysis could not detect a valid SDK that can use this package.",
    "score": 20.0
   }
  ]
 },

Build failure: https://travis-ci.org/dart-lang/linter/jobs/624732589

Linter pubspec: https://github.com/dart-lang/linter/blob/master/pubspec.yaml

Could you help me resolve?

/cc @isoos @jonasfj

I propose that we grant 10 points to packages with a LICENSE file from which we can detect a license.

We are currently to detect the license of most packages, see: https://github.com/dart-lang/pub-dev/issues/4373#issuecomment-1042778403

Investigation of which license we fail to detect is filed as https://github.com/dart-lang/pana/issues/1015

Packages that don't use one of the licenses from https://github.com/dart-lang/pana/tree/master/lib/src/third_party/spdx/licenses won't get these 10 points. That is unfortunate for packages with a commercial license. But we could say that if the LICENSE file starts with the string:

**THIS PACKAGE REQUIRES A COMMERCIAL LICENSE**\n (followed by whatever license the package wants to use)

Then we detect the license as license:commercial or license:proprietary and grant the 10 points. So we simply have a string that indicates the package is commercial and we shouldn't do license detection for it.

When license detection fails, we can link to a page on dart.dev that explains:

• How license detection on LICENSE works, and how to run pana's license detection locally.
• How opt-out of license detection by marking a package a commercial (using the magic string).

Questions:

• What string should we use in LICENSE to indicate a proprietary / commercial package?
  • Option: **THIS PACKAGE IS COMMERCIALLY LICENSED**\n
  • Option: **THIS PACKAGE REQUIRES A COMMERCIAL LICENSE**\n
• Should we use the term license:commercial in the UI?
  • Option: license:proprietary
  • Option: license:commercial

Bumps actions/checkout from 3.1.0 to 3.2.0.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Using #1184 to compare licenses on pub.dev, the following changes happened:

 36                    +Apache-2.0: about, about_custom, button_uz, dart_inject, dio_retry_plus, expandable_text_widget, ez_flutter_common, fcapi, flutter_2d_amap, flutter_file_preview, flutter_font_icons, flutter_mapbox, flutter_mapbox_nav, flutter_mapbox_navigation, flutter_vtmap_navigation, flutter_zoom, flutterfileselector, full_screen_image, full_screen_image_null_safe, hw_package_demo, hw_plugin_demo, ios_rotate_image, iwaju_utils, jazzicon, mkuna_bamantra, mwl_util_package, platform_svg, plugng, plus_dio_retry, scrollable_list, sigmob_plugin, simple_dart_api, wolfizutils, xfvoice, xfvoice2, ziggeo
     6            +BSD-3-Clause-Clear: bd_l10n, cli_goodies, db_navigator, db_test_coverage, utils_flutter, vcshooks
     1               +BSD-4-Clause-UC: sysexits

There are interesting misses: e.g. in flutterfileselector, which has a headline of BSD, but looks like Apache. However, most of the changes are correct, and overall, I think it is positive change.

• Currently shares URL problems and repository verification results.
• Added a new method to invoke multiple versions of the same package with shared context.

https://pub.dev/packages/googleclouddatastore/pubspec

has summary.allDependencies that includes protoc-plugin.

Context: I noticed this because I have APIs that sanitizes output from pana, and protoc-plugin is not a valid package name, so it complained.

IMO, summary.allDependencies should be all packages that when updated may affect the analysis of this package. Or we should introduce another property on summary that is dependencies as a list of package names that when updated should trigger reanalysis.