Upgrading pana 0.22 to 0.23
Breaking0.22.24 → 0.23.19Breaking5Security5New9Changed26Fixed16Other21
SecurityPrevents following symlinks when writing dartdoc_options.yaml and analysis_options.yaml.#1606 ↗
BreakingUpgrade verdict
5 breaking changes and 5 security fixes.
In plain terms
- You must now pass --project-root to tell pana where the project is, because it no longer detects it from git.
- Old, deprecated ways of using the package are gone, so code that relied on them will stop working.
- Callers that passed a package name to this SDK constraint helper must stop doing so.
- Two ToolEnvironment helper methods are gone, so code calling them will no longer compile.
Must act Top 5 of 10 that need code or config changes
Dart SDK requirement changed in 0.23.13: ^3.9.0 → ^3.11.0.
What you must change
Breaking5
Adds --project-root CLI option; git-based detection is removed, so users must specify the directory explicitly.
--project-rootRemoves deprecated APIs and starts the 0.23.0 release line.
Removes the packageName parameter from SdkConstraintStatus.fromSdkVersion.
SdkConstraintStatus.fromSdkVersionpackageNameRemoves withRestrictedAnalysisOptions and runUpgrade methods from ToolEnvironment.
ToolEnvironmentwithRestrictedAnalysisOptionsrunUpgradeRemoves the line-length option from CLI args and API options.
line-lengthSecurity5
Prevents following symlinks when writing dartdoc_options.yaml and analysis_options.yaml.
dartdoc_options.yamlanalysis_options.yamlRejects screenshot paths containing colons and validates sandbox output folders.
Validates repository URL reachability before creating a local git repository.
Bounds the pubspec inspection loop with a timeout and enforces maxOutputBytes.
maxOutputBytesProtects against YAML alias expansion bombs in yamlToJson.
yamlToJson