GitHub extends supply chain security to Dart
GitHub has added support for the Dart ecosystem across its software supply chain security features. The work follows a collaboration with Google's Dart team, and it brings dependency visibility, vulnerability detection and automated patching to developers using Dart and Flutter.
Dart's adoption is significant: Flutter-based applications such as Google Ads, eBay Motors and Alibaba Xianyu all rely on the language. With this update, those ecosystems gain the same security tooling GitHub already offers for other languages, helping developers track and maintain the libraries their projects depend on.
What's now available for Dart
GitHub Advisory Database
The GitHub Advisory Database now accepts Dart-related vulnerability information. Package maintainers can use GitHub Security Advisories to privately coordinate with reporters on a fix before a vulnerability is made public. If a Dart vulnerability with an assigned CVE is missing from the database, it can be submitted as a community contribution.
Dependency graph and review
GitHub's dependency graph parses a repository's pubspec.yaml and pubspec.lock files to map the Dart packages in use. The graph underpins Dependabot's vulnerability alerts and automatically generated update pull requests. The Insights tab on a repository page shows the detected dependencies.
The dependency graph is on by default for public repositories, while owners must enable it manually for private ones. For pull request-time checks, the dependency review GitHub Action scans changes to Dart dependencies and blocks known vulnerable versions from being merged.
Dependabot alerts and security updates
Dependabot alerts kick in when a newly disclosed vulnerability affects Dart packages already in use at a repository. Dependabot security updates then generate pull requests that bump the affected package to a patched release. Both alert notifications and security update behavior can be tuned per repository.
Dart documentation and next steps
GitHub has published corresponding documentation on securing Dart repositories. The relevant references cover security advisories, dependency graph usage, dependency review setup, Dependabot alerts and Dependabot security updates.
