pub
Last updated July 30, 2026View source (v0.21.1)
Bomly uses this chain when it finds pub evidence.
| Property | Value |
|---|---|
| Package manager | pub |
| Ecosystem | dart |
| Detector chain | pub-native-detector, pub-detector, syft-detector |
| Evidence patterns | pubspec.lock, pubspec.yaml, pubspec.yml |
| Ignored directories | - |
| Ignored directory markers | - |
| Multi-module resolution | No |
| Install-first support | No |
| Remediation hints | None |
| Native command hints | dart, syft for bomly-lite |
Source details
Bomly reads hosted, Git, and path sources from pubspec.lock or native pub
output. An unrecognized source type stays unknown.