pana

• Allow more pass-through in analysis_options.yaml.
• Prevent following symlinks when listing and inspecting files in a package directory.
• Tagger now checks web plugin implementations for is:wasm-ready.
• Updated dev_dependency handling: keep for analysis, remove for upgradability.
• --project-root CLI option to specify the project's root directory.
  When specified, pana copies the entire tree for analysis.
  BREAKING CHANGE: the git-based detection is no longer used, users
  must specify the directory explicitly.

• Allow more pass-through in analysis_options.yaml.
• Prevent following symlinks when listing and inspecting files in a package directory.
• Tagger now checks web plugin implementations for is:wasm-ready.
• Updated dev_dependency handling: keep for analysis, remove for upgradability.
• --project-root CLI option to specify the project's root directory. When specified, pana copies the entire tree for analysis.
  BREAKING CHANGE: the git-based detection is no longer used, users must specify the directory explicitly.

What's Changed

• Prevent following symlinks when writing dartdoc_options.yaml and analysis_options.yaml by @sigurdm in #1606
• Use dart-lang/ecosystem firehose workflow for publishing by @sigurdm in #1604
• Bump analyzer from 13.3.0 to 14.1.0 by @dependabot[bot] in #1603
• Reject screenshot paths with colons and validate sandbox output folders by @sigurdm in #1609
• Widen analyzer constraint by @sigurdm in #1610
• Validate repository URL reachability before creating local git repository by @sigurdm in #1608
• Bound pubspec inspection loop with timeout and enforce maxOutputBytes by @sigurdm in #1607
• Parallelize end-to-end golden tests by @sigurdm in #1612
• Exclude test and example directories from analysis with options file. by @isoos in #1611
• Stream processing of 'dart analyze' stdout for better and more resilient parsing. by @isoos in #1596
• Re-enable 'include:' in analysis_options.yaml by @isoos in #1613
• Disable plugins in 'dart analyze' by @isoos in #1614
• Keep sdk dev_dependencies when updating pubspec.yaml by @isoos in #1615
• Passthrough 'analyzer: exclude:' in 'analysis_options.yaml' by @isoos in #1616

Full Changelog: 0.23.16...0.23.17

• Parallelize end-to-end golden tests with a shared test environment and concurrency pool.
• Delete symlinks before writing dartdoc_options.yaml and analysis_options.yaml to prevent out-of-tree file writes.
• Reject screenshot paths containing colons and validate sandbox output folders.
• Validate repository URL reachability before creating local git repository.
• Bound pubspec.yaml scanning in repository verification with a timeout and enforce maxOutputBytes in GitTool.showFile.
• Stream processing of dart analyze stdout for better and more resilient parsing.
• Re-enabled include: in analysis_options.yaml.
• Disabled plugins in dart analyze
• Passthrough for analyzer: exclude: in analysis_options.yaml
• Keeping sdk: dev_dependencies when updating pubspec.yaml.

What's Changed

• Protect against YAML alias expansion bombs in yamlToJson by @sigurdm in #1605

Full Changelog: 0.23.15...0.23.16

• Protect against YAML alias expansion bombs (Billion Laughs), cyclic references, and extreme nesting depth in yamlToJson.

What's Changed

• Temporary opt-out from --sanitize-html CLI arg when calling dartdoc. by @isoos in #1601

Full Changelog: 0.23.14...0.23.15

• Set PANA_OPT_OUT_DARTDOC_SANITIZE_HTML environment variable to true to skip --sanitize-html CLI arg when running dartdoc. This is an internal, temporary option, which will be changed (or reverted) in a future release.

What's Changed

• Bump actions/checkout from 6.0.2 to 7.0.0 in the github-actions group by @dependabot[bot] in #1597
• Fix conditional export configuration keys by @leehack in #1594
• Prepare release 0.23.14 by @isoos in #1598

New Contributors

• @leehack made their first contribution in #1594

Full Changelog: 0.23.13...0.23.14

• Fix: use lexeme in package:analyzer to properly detect conditional imports.

What's Changed

• Bump dart-lang/setup-dart from 1.7.1 to 1.7.2 in the github-actions group by @dependabot[bot] in #1582
• Upgrade dependencies including analyzer. by @isoos in #1586
• Refactor webp-related method to separate WebpTool class. by @isoos in #1570
• Upgrade CI versions by @isoos in #1587
• Move jsonDecode inside the try-catch block during dependency report checks by @isoos in #1591
• Rename web_tool->webp_tool.dart by @isoos in #1590
• Fix: git file list parsing bug. by @isoos in #1588
• Detect legacy Kotlin configuration in Android plugins by @sigurdm in #1592

Full Changelog: 0.23.12...0.23.13

• Detect legacy Kotlin Gradle Plugin application and kotlinOptions in Android plugins.
• Upgraded dependencies to the latest.

What's Changed

• Only deduct scores for missing swiftpm support for actual darwin plugins by @sigurdm in #1579
• Prepare 0.23.12 by @isoos in #1581

Full Changelog: 0.23.11...0.23.12

• Only subtract points for missing swiftpm support for actual darwin plugins.

What's Changed

• Re-run pub commands with --verbose after a failure. by @isoos in #1561
• Upgrade dartdoc version in end2end test + upgraded goldens timestamp + data. by @isoos in #1565
• Refactor: GitTool for high-level git commands. by @isoos in #1568
• Use '-z' (zero-byte separator) for git listing. by @isoos in #1569
• Use default package when detecting swiftpm compatibility of federated plugin by @sigurdm in #1576

Full Changelog: 0.23.10...0.23.11

• Re-run pub commands with --verbose after a failure.
• Updated end2end tests to latest dartdoc.
• Use -z (zero-byte separator) for git listing.
• Use default package when detecting swiftpm compatibility of federated plugin.

What's Changed

• Support more CLI arguments: sandbox-runner, dartdoc-command by @isoos in #1559
• Bump actions/checkout from 6.0.1 to 6.0.2 in the github-actions group by @dependabot[bot] in #1557
• Updated platform report: partial score for wasm and switft manager incompatibility. by @isoos in #1563
• Better parsing and ignoring known issues of 'dart format' error. by @isoos in #1560
• Prepare release + small fixes by @isoos in #1564

Full Changelog: 0.23.9...0.23.10

• Support for --sandbox-runner and --dartdoc-command CLI options.
• Updated platform report: partial score for WASM and Swift package manager incompatibility.
• Better parsing of dart format output.

What's Changed

• Add --license-data option to support AOT compilation by @jonasfj in #1552
• Run git and webp with the sandbox runner. by @isoos in #1555
• Fix compiled pana's package:analyzer issues + separate self-run test. by @isoos in #1556
• Prepare 0.23.9 by @isoos in #1558

Full Changelog: 0.23.8...0.23.9

• Added --license-data argument to specify the location of SPDX license data (useful for AOT compilation).
• Run webp- and git-commands inside the sandbox (if it was provided).

• Updated option to list of arguments to run precompiled dartdoc binary.

• Use only dart commands, Flutter SDK will be used when FLUTTER_ROOT is set.
• Option to use a precompiled dartdoc binary.

• Always use flutter pub pub when invoking pub with Flutter SDK.
• Omit pubspec.yaml warning about local path dependency in the report.
• Fix type cast issue when customizing analysis_options.yaml.
• Do not export FLUTTER_ROOT environment for Dart-only SDK.
• Option to call a sandbox runner for tool environment commands.

• Include more top-level analysis target in static checks.

• ToolEnvironment flag to use include: entries in analysis_options.yaml.

• Support for multiple include: entry in analysis_options.yaml.
• Fix issue with PUB_HOSTED_URL with custom path segments.

• Allow package:analyzer range to accept ^9.0.0 too.
• Fix issue where screenshots with same filenames but located in different subdirectories were overwriting each other during processing.
• Only complain about wasm support for web-enabled packages.

• Support passthrough of unrelated linter rules in analysis option customization.
• Support passthrough of unrelated analyzer errors in analysis option customization.
• Added new license files.

Breaking changes:

• Removed deprecated API.
• Removed Range and Position from the model, added TextOp to list changes and matching parts in the license.
• Removed packageName from SdkConstraintStatus.fromSdkVersion constructor.
• Removed ToolEnvironment methods: runUpgrade (use runPub instead) and withRestrictedAnalysisOptions (no replacement).
• SDK constraint is no longer added to old pubspec.yaml
• Removed --line-length CLI argument and also lineLength from analysis options. Use configurable page width instead.

• Fixed small ambiguity in the order of license match evaluation.
• Resolve analysis_options.yaml dev dependency to expose transitive formatter options.
• Fixed license coverage calculation.
• Fixed license match post-filtering.

• Upgraded SDK constraint: ^3.8.0.
• Updated License with Range? range field that identifies the recognized block.

• Do not list SDK packages in the outdated packages report.
• Deprecated downloadPackage, use the new ToolEnvironment.unpack instead.
• Fix issue with analyzing packages nested inside git repositories on windows. https://github.com/dart-lang/pana/issues/1207
• Check the reference of the current version in CHANGELOG.md.

• Preserve all formatter settings in analysis_options.yaml when doing dart format.

• Reduced minimum description length to 50 characters.
• Filter SDK package flutter from the outdated report.

• Extended recognized image extensions in URL resolver.
• Preserve formatter:page-width when doing dart format.
• Lower score for packages with discontinued dependency.

• Make example's README.md priority over any dart file in the examples directory.
• Expose more precise repository verification status in AnalysisResult.
• Track URL issues with explicit acceptance state (404 status does not cause score deduction). Also display such URLs in AnalysisResult.

• Fixed lower dependency constraint for cli_util.
• Use flutter pub global activate dartdoc for Flutter packages.

• Fixed deprecated API use.
• Preparing to use with dartdoc 8.3.0.

• Detect support for Swift Package Manager for ios/macos plugins.
• Fixes issue with local analysis without git repository root.
• Accept logger in PackageAnalyzer.inspectDir method.

• Pass-through for formatter/page_width in analysis_options.yaml.
• Upgraded lints to ^5.0.0

• Updated report text for wasm readiness.
• Updated paragraph separation in report sections.

• Expose wasm readiness analysis in the report (without any score).

• Remove workspace and resolution properties from pubspec before analyzing.

• Updated suggestion for packages depending on SDK _macros.
• Deprecated the renderSimpleSectionSummary method in public API.

• Updated dependency: tar: ^2.0.0.
• New text logging format.
• Migrating Summary.licenseFile and Summary.licenses to AnalysisResult.licenses.
• Breaking change: Removed ToolEnvironment.panaCache field (not intended for public API).

• Enable macros experiment pass-through in analysis_options.yaml.
• Verify executables in pubspec.yaml and check if the related files exist.
• Fixed has:executable check.

• New recognized example files in the example/bin directory.
• Add has:executable tag for packages with bin/<executable>.dart files.

• Updated text and link on downgrade analysis.

• Report and score pub downgrade + dart analyze.

• Do not emit package names in allDependencies with trivial syntax issues.
• Log dartdoc output.

• dartdoc processing is run as the last step of the generated report.
• Fix: missing custom SDK environment (config directory use) when invoking Flutter.

• Fix: unspecified --dartdoc-version will use the latest version in an isolated environment. To use the SDK's dartdoc, set the value to sdk.

• ToolEnvironment:
  • .create() takes configHomeDir to specify config the home directory used for the analysis (helps switching different analyzer SDKs).
  • create() takes pubHostedUrl as PackageAnalyzer.create() was removed.
• InspectOptions:
  • totalTimeBudget to allow the dynamic reduction of dartdocTimeout.
  • resourcesOutputDir to store the resources files (without the previous callback).
• bin/pana.dart accepts new CLI arguments:
  • --dart-config-home (hidden)
  • --flutter-config-home (hidden)
  • --dartdoc-output (hidden)
  • --dartdoc-version
  • --dartdoc-timeout (hidden)
  • --resources-output (hidden)
  • --total-timeout (hidden)

BREAKING CHANGES

• Renamed runProc -> runConstrained.
• Removed:
  • deprecated APIs
  • InspectOptions.checkRemoteRepository - repositories are verified by default
  • PackageAnalyzer:
    • create()
    • inspectVersions()
    • storeResource callback in inspectPackage(), use InspectOptions.resourcesOutputDir instead
  • ProcessOutput.asBytes
  • Report.joinSection()
  • ToolEnvironment:
    • create() method dropped useGlobalDartdoc flag, will use global dartdoc when dartdocVersion is specified, otherwise uses the Dart SDK's dart doc.
    • create() method dropped dartSdkDir, flutterSdkDir, and environment, using SdkConfig for each of the SDKs.
    • removed parameters from dartdoc()
    • detectFlutterUse()
    • get dartSdkDir
    • get flutterSdkDir
    • get environment
    • getFlutterVersion()
  • analysisOptionsFiles
  • changelogFileNames
  • currentAnalysisOptionsFileName
  • dartdocFailedSection
  • documentationCoverageSection()
  • documentationSectionTitle
  • firstFileFromNames
  • licenseFileNames
  • pubspecParseError
  • readmeFileNames
• ToolException has reference to the entire PanaProcessResult, instead of just the stderr.

• Fix: don't report hidden constructors as undocumented API symbols.

• Fix: dart:ui_web is now part of the SDK-detection library list.
• The use of kind in pub-data.json is deprecated, as it may contain different value on different dartdoc version. The field may be removed in a future version.

• Fix: limit number of documentation entries exported in pub-data.json.
• Fix: Add dart:js_interop_unsafe as a web library.
• Pre-compute missing documentation symbol before pruning the results.

• Fix: global dartdoc activation is forced to happen from pub.dev.

• Pana binary now runs dartdoc and generates report based on the coverage (the same that pub-dev is using). The --no-dartdoc command line argument skips this part of the analysis.
• Breaking change: running the global dartdoc has become the default (instead of the SDK's dart doc), because the latest SDK is behind the latest dartdoc version, and we want to control what is being used by the analysis.
• Breaking change: ToolEnvironment.dartdoc returns PanaProcessResult.

• Fix: empty yaml parsing.
• Upgraded package:lints to 3.0.0.

• Removed file size checks. (If upload limits allow it, pana should not complain.)

• Added dart:ui_web as Flutter Web platform.
• Fix: static analysis is done only when the package resolution was successful.

• --no-warning is no longer needed, and has no effect.
• Fix: expose repository verification issues in report.
• Upgraded package:tar to 1.0.0.
• Added AnalysisResult.grantedPoints and AnalysisResult.maxPoints.

• Always use dart format instead of flutter format.

• Merge Dart 3 compatibility report into static analysis.
• Breaking change: Remove future SDK flags.
• Upgrading to package:analyzer 6.0.0

• Export missing PanaProcessResult.
• Fix package:lints as main dependency.

• Do not block repository check when pubspec.yaml is in path that is not accepted.
• Upgraded to Dart 3.0.
• Resolve package:lints/core.yaml locally before loading from GitHub.
• InspectOptions.analysisOptionsYaml is now deprecated.
• Removed null-safety report (Dart 3 compatibility report is used by default).

Breaking changes:

• PanaProcessResult no longer implements dart:io's ProcessResult.
• DartdocResult uses PanaProcessResult instead of ProcessResult.
• Deprecating InspectOptions.futureSdkTag, configuration no longer used.

• Check the latest 2.x release compatibility only for Dart 2.x packages.

• Dart 3 compatibility section label includes Flutter 3.10 when applicable.
• Code cleanup in ToolEnvironment.

• Fix pub upgrade to exclude example directory.

• New report section: Dart 3 compatibility.