pub
Last updated October 25, 2026View source (v0.30.0)
This page explains how Bomly builds a dependency graph for pub projects: the detector chain it runs, what that chain needs, and what it can report.
| Property | Value |
|---|---|
| Package manager | pub |
| Ecosystem | dart |
| Detector chain | pub-native-detector, pub-detector, syft-detector |
| Evidence patterns | pubspec.lock, pubspec.yaml, pubspec.yml |
| Multi-module resolution | No |
| Install-first support | No |
| Remediation hints | None |
| Commands the chain may run | dart. The Syft fallback is built in; the lite build runs an external syft from PATH instead. |
Source details
Bomly reads hosted, Git, and path sources from pubspec.lock or from the output of the dart tool. An unrecognized source type stays unknown.