Dart / Pub

Introduction

JFrog Xray provides security and compliance analysis for Dart (Flutter) applications throughout the software development lifecycle. This page describes the supported scan contexts, capabilities, and dependency analysis available for Dart.

Capabilities

Capability	Source Code Scanning	Binary Scanning
Vulnerability Matching (CVEs)	🔜	✅
License Detection	🔜	✅
Malicious Package Detection	❌	❌
Operational Risk	❌	❌
Smart Remediation	❌	❌

SCA capabilities are not currently available for Dart in the source code scanning context.

Supported Files

Package Manager	Supported Files
Pub	❌ Not supported

Supported Files

Package Manager	Supported Files
Pub	`pubspec.lock` – Flat package list, no dev dependency distinction, hosted packages only

Dependency Graph

Package Manager	Dependency Graph
Pub	❌ Flat – No dependency tree, Git/path deps skipped

Binary scanning analyzes built artifacts stored in Artifactory repositories, extracting package metadata from the artifact format itself.

Supported Files

Package Manager	Supported Files
Pub	Pub package archives