Summary
Ollie approved the lockfile/release hardening work and pointed out an additional supply-chain safeguard to watch: Dart pub is considering support for a minimum package age / dependency cooldown policy.
The concern is that dart pub get or dart pub upgrade can currently resolve a package version that was published only seconds earlier. That creates supply-chain risk because malicious or compromised package releases are often detected within hours or days, and immediate adoption removes that natural detection window.
Relevant Dart pub work
From the PR discussion, the proposed approach appears to let projects declare a policy block in pubspec.yaml, with a cooldown policy restricting which dependency versions are eligible for resolution. The policy feature currently requires a Dart language version of at least 3.13.
Why this matters for raygun-cli
This repo produces CLI release binaries, so dependency resolution is part of the release supply chain. We already track and enforce pubspec.lock, but a dependency cooldown would add another layer of protection when intentionally updating dependencies.
Proposed follow-up
When Dart pub ships dependency cooldown support:
- Review the final syntax and Dart SDK/language version requirements.
- Decide an appropriate cooldown window for this repo.
- Add the policy to
pubspec.yaml if compatible.
- Update
README.md and AGENTS.md release/dependency guidance.
- Confirm CI and release workflows continue to pass with
dart pub get --enforce-lockfile.
Context
This came out of a discussion after the lockfile/release hardening PR was approved. Ollie called it a useful safety net for supply-chain attacks, and Kai suggested creating this issue so we do not forget to revisit it.
Summary
Ollie approved the lockfile/release hardening work and pointed out an additional supply-chain safeguard to watch: Dart pub is considering support for a minimum package age / dependency cooldown policy.
The concern is that
dart pub getordart pub upgradecan currently resolve a package version that was published only seconds earlier. That creates supply-chain risk because malicious or compromised package releases are often detected within hours or days, and immediate adoption removes that natural detection window.Relevant Dart pub work
From the PR discussion, the proposed approach appears to let projects declare a policy block in
pubspec.yaml, with a cooldown policy restricting which dependency versions are eligible for resolution. The policy feature currently requires a Dart language version of at least 3.13.Why this matters for raygun-cli
This repo produces CLI release binaries, so dependency resolution is part of the release supply chain. We already track and enforce
pubspec.lock, but a dependency cooldown would add another layer of protection when intentionally updating dependencies.Proposed follow-up
When Dart pub ships dependency cooldown support:
pubspec.yamlif compatible.README.mdandAGENTS.mdrelease/dependency guidance.dart pub get --enforce-lockfile.Context
This came out of a discussion after the lockfile/release hardening PR was approved. Ollie called it a useful safety net for supply-chain attacks, and Kai suggested creating this issue so we do not forget to revisit it.