Dependency audit for Dart and Flutter, built for CI

When I join an existing project, the first thing I want to know is how much legacy I just signed up for. The code will tell you, but slowly. The pubspec tells you fast: if half of the dependencies are dead, abandoned, or stuck because their latest version needs a newer Dart SDK than yours, that says a lot before you read a single line of code. The same questions come up in code review every time someone adds a new package. Is it alive? Is it maintained? Is it the current major? I wanted one command that answers all of this, and a CI check that asks it for me on every pull request.

I went looking for a tool and found pieces. dependency_validator finds unused packages and does it well. dart pub outdated mentions discontinued ones if you read carefully. DCM has a nice check, but it is a paid product. Nothing free would just look at my project and say: these four packages are unused, this one is dead and here is its replacement, and by the way you forgot a path override in your pubspec.

So I built it. It is called pubspec_doctor and it works like this:

$ pubspec_doctor

Unused dependencies:
  - collection
  - rxdart

Discontinued packages:
  - flutter_markdown (replaced by: flutter_markdown_plus)

Stale packages (no release in a long time):
  - some_pkg (latest 0.3.1 published 1204 days ago)

It returns exit code 1 when something is wrong, exactly like a test suite. So the simplest integration is one line in any CI system, right after your tests. The whole interface fits in a few lines:

pubspec_doctor                        # audit the current directory
pubspec_doctor --path packages/app    # or any other package
pubspec_doctor --ignore build_runner  # exclude a package from all checks
pubspec_doctor --stale-days 365       # stricter staleness threshold
pubspec_doctor --offline              # no pub.dev calls, unused analysis only
pubspec_doctor --fail-on-stale        # stale packages also fail the build
pubspec_doctor --json                 # machine-readable report
pubspec_doctor --fix                  # remove unused deps, fix sections, drop overrides
pubspec_doctor --fix-outdated         # also bump constraints stuck on an old major

# exit codes: 0 = clean, 1 = problems found, 2 = could not run

If you are on GitHub Actions, it gets better. There is a ready made Action, so a full dependency audit for your pull requests is one step:

name: Dependency audit
on: [pull_request]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: PopovVA/pubspec_doctor@v0
        with:
          args: --fail-on-stale

Now a pull request that adds a dead or unused dependency simply goes red. And the findings do not hide in the logs. The tool prints GitHub annotations, so every problem shows up right on pubspec.yaml in the Files changed tab, like a review comment. The person who added the package sees exactly which line is guilty and why.

Get Leon Redfield’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Since then it also learned to check promotion (a dependency that only your tests use should live in dev_dependencies, and the reverse case is worse, because it breaks people who depend on your package), to find leftover path and git overrides before they escape into a release, and to walk pub workspaces so monorepos get a report per package.

The newest part is fix mode. Run pubspec_doctor --fix and it edits pubspec.yaml for you: unused packages get removed, wrongly placed ones move to the right section, forgotten path and git overrides disappear. Comments and formatting stay exactly as they were. Version bumps live behind a separate flag, --fix-outdated, because jumping to a new major can break things and that choice should be explicit. And nothing is ever written without one of these flags, so a plain run stays read only.

It is free and open source, MIT license. Install it with one command:

dart pub global activate pubspec_doctor

Then run

pubspec_doctor

I would honestly love to hear where it is wrong. False positives are the death of tools like this, so if it flags something in your project that is actually used, please open an issue.

The repo is github.com/PopovVA/pubspec_doctor and the package is on pub.dev.