Dart

Analyze Dart and Flutter projects with FOSSA through the pub package manager, using Quick Import or the FOSSA CLI.

4 min readUpdated Jul 9, 2026

Overview

FOSSA supports Dart and Flutter projects through pub, the package manager for the Dart ecosystem. Pub manages shared packages and libraries, which can be sourced from the pub registry, a git repository, or the local file system.

Tool support

Tool	Quick Import (app.fossa.com)	CLI (fossa-cli)
Dart (pub)	N/A	`pubspec.yaml`

How Quick Import works

Dart projects are not supported through Quick Import in the web app. To analyze a Dart or Flutter project, use the FOSSA CLI.

Note

There is no Quick Import path for pub. Run the FOSSA CLI inside your build environment to analyze Dart and Flutter projects.

Analyzing with the CLI

Install the latest release of fossa-cli:

Shell

curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.sh | bash

Then run fossa analyze from your repository's root directory to analyze your Dart or Flutter project using pub. FOSSA discovers Dart projects by finding pubspec.yaml files. See the pub strategy reference for the full page.

Warning

Run flutter pub get (or dart pub get) before fossa analyze to ensure all dependencies are resolved. This creates the pubspec.lock file and lets the pub deps -s compact command produce edges between direct and transitive dependencies.

Analysis strategies

FOSSA attempts all of the strategies below and selects the result of the succeeded strategy with the highest preference.

Preference	Strategy	Direct Deps	Transitive Deps	Edges	Container Scanning
Highest	`pubspec.yaml` and `pubspec.lock` discovered, and `flutter pub deps -s compact` can be executed	✅	✅	✅	❌
	`pubspec.yaml` and `pubspec.lock` discovered, and `dart pub deps -s compact` can be executed	✅	✅	✅	❌
	`pubspec.yaml` and `pubspec.lock` discovered, and `pub deps -s compact` can be executed	✅	✅	✅	❌
	`pubspec.yaml` and `pubspec.lock` discovered	✅	✅	❌	✅
Lowest	Only `pubspec.yaml` discovered	✅	❌	❌	✅

✔️, Supported in all projects
✅, Supported only when relevant data is available
❌, Not supported

Limitations

Path dependencies are not reported, and are ignored in analyses. All descendant dependencies of the path dependency are promoted to the ancestor of the path dependency.
SDK dependencies are not reported, and are ignored in analyses. All descendant dependencies of the SDK dependency are promoted to the ancestor of the SDK dependency.

Authenticating to private registries

You can configure FOSSA to resolve dependencies from private pub servers.

1
Open Pub language settings
Go to Account Settings → Languages → Pub (https://app.fossa.com/account/settings/languages/pub).
2
Add your server
Enter the server ID, URL, and an authentication token for each private pub server FOSSA should use, then save.

FOSSA can now resolve packages from your private pub servers.

Package data

When the pub deps command runs successfully and a lockfile is discovered, FOSSA produces a dependency graph with both direct and transitive dependencies, including the edges between them.

Accent green nodes are direct dependencies; dashed-border nodes are transitive. Descendant dependencies of SDK dependencies are promoted to their ancestor.

If the pub deps command does not run successfully, FOSSA falls back to a graph derived from the lockfile or manifest alone.

Only direct dependencies are listed; edges between packages are not resolved without a successful pub deps run.