dart-package-maintenance — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dart-package-maintenance (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Guidelines for maintaining Dart packages in alignment with the canonical Dart team External Package Maintenance specification.
Use this skill when:
changes in a repository.
CHANGELOG.md synchronization, and publishing workflows.Do NOT apply package maintenance version bumps or changelog updates when:
publish_to: none inpubspec.yaml that are not published to pub.dev (e.g., application root packages or internal monorepo tooling).
that only modify repository-level files outside a published package (such as .github/workflows/, repo-root SKILL.md, or root docs in a monorepo) or that only fix typos/formatting in historical CHANGELOG.md sections.
where the version already carries an appropriate -wip suffix.
Dart packages use semantic versioning with a pre-1.0.0 variation where the version numbers are shifted to the right before a 1.0.0 release; see also the package:pub_semver semantics:
major.minor.patch.0.major.minor, where the second number isbumped for breaking changes, such as 0.4.2 to 0.5.0-wip, and the third number is bumped for non-breaking features and bug fixes, such as 0.4.2 to 0.4.3-wip. Avoid +1 build suffixes (in package:pub_semver, 0.4.2+1-wip parses +1-wip as build metadata rather than a -wip pre-release).
1.0.0 as soon as the package is stable.Choose the version bump based on the impact of the change:
pubspec.yamlexecutables entry.
new class or adding a pubspec.yaml executables entry.
environment.sdk or runtime dependenciesconstraint updates, or any other change that does not impact calling code.
Whenever the code in the repo differs from the latest version published on pub.dev, both pubspec.yaml and CHANGELOG.md must use a -wip version. We bump to -wip on the _first_ change after a release, even if we don't plan on publishing the code in that state or if the change doesn't impact consumers.
When opening or merging a PR, check the current version in pubspec.yaml and CHANGELOG.md:
1.2.3: Perform the appropriateversion bump, append -wip in pubspec.yaml, and add a matching ## <version>-wip section at the top of CHANGELOG.md.
1.2.4-wip: Compare the existing-wip bump against the bump required for your change. If your change requires a larger bump, such as from a _patch_ bump to a _minor_ bump when adding a feature, update pubspec.yaml and rename the existing ## <version>-wip heading in CHANGELOG.md in place.
0.1.0-wip: Keep 0.1.0-wip and the- Initial release. entry without adding per-PR changelog entries until after the first release.
CHANGELOG.md-wip section.cleanups, test/, tool/, or README.md updates, or dev_dependencies and dependency_overrides changes:
-wip section, add the ## <version>-wipheading with no bullet items below it.
-wip version, leave CHANGELOG.mduntouched and apply the skip-changelog-check PR label.
an unreleased change in the current -wip section, such as bumping an SDK or dependency constraint again before publishing, update or remove the existing -wip bullet in place instead of adding a duplicate entry.
already-published version heading, especially after merging main when a release landed while your PR was open.
downstream breakage.
-wip suffix from pubspec.yaml andCHANGELOG.md in a dedicated pull request.
dart pub publish (or flutter pub publish) and resolveall warnings and errors.
v1.2.3package_name-v1.2.3git tag v1.2.3 && git push --tagsupon merging.
main into the PR branch rather thanrebasing to resolve conflicts. This preserves the review history and comments.
gh pr checkout <number> to inspect changes locallyin your IDE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.