This answer has two parts, similarly to the question and answer in this question about Ruby bundler
.
Application packages
If you are working on an application package, then you should keep the pubspec.lock
file in your repository as a snapshot of your dependencies.
From the Pub glossary:
Application packages should check their lockfiles into source control,
so that everyone working on the application and every location the
application is deployed has a consistent set of dependencies.
Library packages
However, if you are working on a library package, then you should not check in the lockfile.
From the Pub glossary:
Library packages should not check their lockfile into source control,
since they should support a range of dependency versions.
See also the Pub glossary entry for lockfiles
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…