# dependency-hygiene

> Claude/Codex skill by [@zakariaf](https://omgskills.com/library/zakariaf/index.md) · 61 stars · Updated 2026-09-23

Enforces pubspec/lock discipline — caret ranges in pubspec.yaml with a committed pubspec.lock as the only pin, a separately-recorded SDK version string, a version-pinned very\_good\_analysis include (whose missing file fails default analyze, or silently drops the ruleset where warnings are non-fatal), transitive-tree auditing before adding a package, a dependency gate that refuses network/telemetry/crash/ads/heavy-transitive deps by policy, and vendoring any bus-factor-1 native plugin behind an interface into third\_party/. Use when running dart pub add/get/upgrade/outdated/deps, editing pubspec.yaml or pubspec.lock, bumping the Flutter/Dart SDK, choosing or rejecting a new dependency, removing a package, or auditing what a dependency drags in.

Tags: agent-skills, ai-agents, best-practices, claude-code, codex, coding-agent, cursor, dart, dartlang, developer-tools, drift, flutter, flutter-architecture, github-copilot, go-router, llm, material-design, mvvm, riverpod, skills

## Install

```sh
git clone https://github.com/zakariaf/Flutter-Skills /tmp/Flutter-Skills && ln -s /tmp/Flutter-Skills/skills/dependency-hygiene ~/.claude/skills/dependency-hygiene
```

## From README

Dependency hygiene Every dependency is a permanent liability someone else may have to service. Optimise for resolves and builds years from now, not for latest. This skill governs pubspec/lock mechanics, the gate a new package must pass, and the escape hatch when a critical package rots. Read the reference for the task at hand: references/dependency-gate-and-audit.md — the refuse/accept gate, transitive auditing, licence recording, upgrade discipline. references/sdk-pin-and-lint-include.md — recording the SDK version and the silent-lint-disable trap on any SDK bump. references/vendoring-behind-an-interface.md — vendoring a bus-factor-1 native plugin into thirdparty/ without touching lib/. Run scripts/audit-deps.sh before a PR that changes pubspec.yaml. Non-negotiable rules Caret ranges in pubspec.yaml, exact pins only in pubspec.lock. drift: ^2.31.0, never drift: 2.31.0. The lock pins; ranges only keep resolution solvable.

## Links

- HTML page: https://omgskills.com/library/zakariaf/flutter-skills/skills/dependency-hygiene/
- GitHub: https://github.com/zakariaf/Flutter-Skills
- Author: [@zakariaf](https://omgskills.com/library/zakariaf/index.md)

## More from this repo

- [accessibility-as-code](https://omgskills.com/library/zakariaf/flutter-skills/skills/accessibility-as-code/index.md) — Enforces accessibility as a correctness property authored into each widget — Semantics(button/label) or...
   - [@zakariaf](https://omgskills.com/library/zakariaf/index.md) · 61 stars
- [adaptive-layout](https://omgskills.com/library/zakariaf/flutter-skills/skills/adaptive-layout/index.md) — Enforces adapting layout by available CONSTRAINTS/size, never device or platform checks — LayoutBuilder +...
   - [@zakariaf](https://omgskills.com/library/zakariaf/index.md) · 61 stars
- [ads-and-iap-monetization](https://omgskills.com/library/zakariaf/flutter-skills/skills/ads-and-iap-monetization/index.md) — Enforces opt-in, rewarded-first monetization over the service seam — a rewarded view grants exactly one benefit and...
   - [@zakariaf](https://omgskills.com/library/zakariaf/index.md) · 61 stars