Bump the github-actions group with 2 updates (#106)

Bumps the github-actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [dart-lang/setup-dart](https://github.com/dart-lang/setup-dart).

Updates `actions/checkout` from 4.1.6 to 4.1.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p>
<blockquote>
<h2>v4.1.7</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump the minor-npm-dependencies group across 1 directory with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li>
<li>Bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li>
<li>Check out other refs/* by commit by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
<li>Pin actions/checkout's own workflows to a known, good, stable version. by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v4.1.6...v4.1.7">https://github.com/actions/checkout/compare/v4.1.6...v4.1.7</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v4.1.7</h2>
<ul>
<li>Bump the minor-npm-dependencies group across 1 directory with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li>
<li>Bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li>
<li>Check out other refs/* by commit by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
<li>Pin actions/checkout's own workflows to a known, good, stable version. by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li>
</ul>
<h2>v4.1.6</h2>
<ul>
<li>Check platform to set archive extension appropriately by <a href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li>
</ul>
<h2>v4.1.5</h2>
<ul>
<li>Update NPM dependencies by <a href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1703">actions/checkout#1703</a></li>
<li>Bump github/codeql-action from 2 to 3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1694">actions/checkout#1694</a></li>
<li>Bump actions/setup-node from 1 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1696">actions/checkout#1696</a></li>
<li>Bump actions/upload-artifact from 2 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1695">actions/checkout#1695</a></li>
<li>README: Suggest <code>user.email</code> to be <code>41898282+github-actions[bot]@users.noreply.github.com</code> by <a href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1707">actions/checkout#1707</a></li>
</ul>
<h2>v4.1.4</h2>
<ul>
<li>Disable <code>extensions.worktreeConfig</code> when disabling <code>sparse-checkout</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1692">actions/checkout#1692</a></li>
<li>Add dependabot config by <a href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1688">actions/checkout#1688</a></li>
<li>Bump the minor-actions-dependencies group with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1693">actions/checkout#1693</a></li>
<li>Bump word-wrap from 1.2.3 to 1.2.5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1643">actions/checkout#1643</a></li>
</ul>
<h2>v4.1.3</h2>
<ul>
<li>Check git version before attempting to disable <code>sparse-checkout</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1656">actions/checkout#1656</a></li>
<li>Add SSH user parameter by <a href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1685">actions/checkout#1685</a></li>
<li>Update <code>actions/checkout</code> version in <code>update-main-version.yml</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1650">actions/checkout#1650</a></li>
</ul>
<h2>v4.1.2</h2>
<ul>
<li>Fix: Disable sparse checkout whenever <code>sparse-checkout</code> option is not present <a href="https://github.com/dscho"><code>@​dscho</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1598">actions/checkout#1598</a></li>
</ul>
<h2>v4.1.1</h2>
<ul>
<li>Correct link to GitHub Docs by <a href="https://github.com/peterbe"><code>@​peterbe</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1511">actions/checkout#1511</a></li>
<li>Link to release page from what's new section by <a href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1514">actions/checkout#1514</a></li>
</ul>
<h2>v4.1.0</h2>
<ul>
<li><a href="https://redirect.github.com/actions/checkout/pull/1396">Add support for partial checkout filters</a></li>
</ul>
<h2>v4.0.0</h2>
<ul>
<li><a href="https://redirect.github.com/actions/checkout/pull/1067">Support fetching without the --progress option</a></li>
<li><a href="https://redirect.github.com/actions/checkout/pull/1436">Update to node20</a></li>
</ul>
<h2>v3.6.0</h2>
<ul>
<li><a href="https://redirect.github.com/actions/checkout/pull/1377">Fix: Mark test scripts with Bash'isms to be run via Bash</a></li>
<li><a href="https://redirect.github.com/actions/checkout/pull/579">Add option to fetch tags even if fetch-depth &gt; 0</a></li>
</ul>
<h2>v3.5.3</h2>
<ul>
<li><a href="https://redirect.github.com/actions/checkout/pull/1196">Fix: Checkout fail in self-hosted runners when faulty submodule are checked-in</a></li>
<li><a href="https://redirect.github.com/actions/checkout/pull/1287">Fix typos found by codespell</a></li>
</ul>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/checkout/commit/692973e3d937129bcbf40652eb9f2f61becf3332"><code>692973e</code></a> Prepare 4.1.7 release (<a href="https://redirect.github.com/actions/checkout/issues/1775">#1775</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/6ccd57f4c5d15bdc2fef309bd9fb6cc9db2ef1c6"><code>6ccd57f</code></a> Pin actions/checkout's own workflows to a known, good, stable version. (<a href="https://redirect.github.com/actions/checkout/issues/1776">#1776</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/b17fe1e4d59a9d1d95a7aead5e6fcd13e50939a5"><code>b17fe1e</code></a> Handle hidden refs (<a href="https://redirect.github.com/actions/checkout/issues/1774">#1774</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/b80ff79f1755d06ba70441c368a6fe801f5f3a62"><code>b80ff79</code></a> Bump actions/checkout from 3 to 4 (<a href="https://redirect.github.com/actions/checkout/issues/1697">#1697</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/b1ec3021b8fa02164da82ca1557d017d83b0e179"><code>b1ec302</code></a> Bump the minor-npm-dependencies group across 1 directory with 4 updates (<a href="https://redirect.github.com/actions/checkout/issues/1739">#1739</a>)</li>
<li>See full diff in <a href="https://github.com/actions/checkout/compare/a5ac7e51b41094c92402da3b24376905380afc29...692973e3d937129bcbf40652eb9f2f61becf3332">compare view</a></li>
</ul>
</details>
<br />

Updates `dart-lang/setup-dart` from 1.6.4 to 1.6.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/dart-lang/setup-dart/releases">dart-lang/setup-dart's releases</a>.</em></p>
<blockquote>
<h2>v1.6.5</h2>
<ul>
<li>Fix zip path handling on Windows 11 (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/118">#118</a>[])</li>
</ul>
<p><a href="https://redirect.github.com/dart-lang/setup-dart/issues/118">#118</a>: <a href="https://redirect.github.com/dart-lang/setup-dart/issues/118">dart-lang/setup-dart#118</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/dart-lang/setup-dart/blob/main/CHANGELOG.md">dart-lang/setup-dart's changelog</a>.</em></p>
<blockquote>
<h2>v1.6.5</h2>
<ul>
<li>Fix zip path handling on Windows 11 (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/118">#118</a>[])</li>
</ul>
<p><a href="https://redirect.github.com/dart-lang/setup-dart/issues/118">#118</a>: <a href="https://redirect.github.com/dart-lang/setup-dart/issues/118">dart-lang/setup-dart#118</a></p>
<h2>v1.6.4</h2>
<ul>
<li>Rebuild JS code.</li>
</ul>
<h2>v1.6.3</h2>
<ul>
<li>Roll <code>undici</code> dependency to address <a href="https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7">CVE-2024-30260</a> and <a href="https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672">CVE-2024-30261</a>.</li>
</ul>
<h2>v1.6.2</h2>
<ul>
<li>Switch to running the workflow on <code>node20`` from </code>node16`. See also
<a href="https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/">Transitioning from Node 16 to Node 20</a>.</li>
</ul>
<h2>v1.6.1</h2>
<ul>
<li>Updated the google storage url for <code>main</code> channel releases.</li>
</ul>
<h2>v1.6.0</h2>
<ul>
<li>Enable provisioning of the latest Dart SDK patch release by specifying just
the major and minor version (e.g. <code>3.2</code>).</li>
</ul>
<h2>v1.5.1</h2>
<ul>
<li>No longer test the <code>setup-dart</code> action on pre-2.12 SDKs.</li>
<li>Upgrade JS interop code to use extension types
(the new name for inline classes).</li>
<li>The upcoming rename of the <code>be</code> channel to <code>main</code> is now supported with
forward compatibility that switches when the rename happens.</li>
</ul>
<h2>v1.5.0</h2>
<ul>
<li>Re-wrote the implementation of the action into Dart.</li>
<li>Auto-detect the platform architecture (<code>x64</code>, <code>ia32</code>, <code>arm</code>, <code>arm64</code>).</li>
<li>Improved the caching and download resilience of the sdk.</li>
<li>Added a new action output: <code>dart-version</code> - the installed version of the sdk.</li>
</ul>
<h2>v1.4.0</h2>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/dart-lang/setup-dart/commit/0a8a0fc875eb934c15d08629302413c671d3f672"><code>0a8a0fc</code></a> rev to v1.6.5 in prep for publishing (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/135">#135</a>)</li>
<li><a href="https://github.com/dart-lang/setup-dart/commit/4e61f04f255b227a0511bf9ef0f5ddc7c8542531"><code>4e61f04</code></a> fix: Use <code>.zip</code> in archive path (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/119">#119</a>)</li>
<li><a href="https://github.com/dart-lang/setup-dart/commit/2986c8e337a31eb7b455ce93dc984e9bf5797756"><code>2986c8e</code></a> blast_repo fixes (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/132">#132</a>)</li>
<li><a href="https://github.com/dart-lang/setup-dart/commit/40a7d12289757ab3aaa39d47d6f99a9cb1dd701e"><code>40a7d12</code></a> Bump dart-lang/setup-dart from 1.6.2 to 1.6.4 (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/131">#131</a>)</li>
<li><a href="https://github.com/dart-lang/setup-dart/commit/40f1ce0b1c8f24a4e9cb7eb026e4dbbdb431eb76"><code>40f1ce0</code></a> Update dart.yml (<a href="https://redirect.github.com/dart-lang/setup-dart/issues/130">#130</a>)</li>
<li>See full diff in <a href="https://github.com/dart-lang/setup-dart/compare/f0ead981b4d9a35b37f30d36160575d60931ec30...0a8a0fc875eb934c15d08629302413c671d3f672">compare view</a></li>
</ul>
</details>
<br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions

</details>
1 file changed
tree: 698384756692fe0a1959172a8e693ad4a4a56501
  1. .github/
  2. example/
  3. lib/
  4. test/
  5. .gitignore
  6. analysis_options.yaml
  7. CHANGELOG.md
  8. LICENSE
  9. pubspec.yaml
  10. README.md
README.md

Dart CI Pub package publisher

Handles version numbers and version constraints in the same way that pub does.

Semantics

The semantics here very closely follow the Semantic Versioning spec version 2.0.0-rc.1. It differs from semver in a few corner cases:

  • Version ordering does take build suffixes into account. This is unlike semver 2.0.0 but like earlier versions of semver. Version 1.2.3+1 is considered a lower number than 1.2.3+2.

    Since a package may have published multiple versions that differ only by build suffix, pub still has to pick one of them somehow. Semver leaves that issue unresolved, so we just say that build numbers are sorted like pre-release suffixes.

  • Pre-release versions are excluded from most max ranges. Let's say a user is depending on “foo” with constraint >=1.0.0 <2.0.0 and that “foo” has published these versions:

    • 1.0.0
    • 1.1.0
    • 1.2.0
    • 2.0.0-alpha
    • 2.0.0-beta
    • 2.0.0
    • 2.1.0

    Versions 2.0.0 and 2.1.0 are excluded by the constraint since neither matches <2.0.0. However, since semver specifies that pre-release versions are lower than the non-prerelease version (i.e. 2.0.0-beta < 2.0.0, then the <2.0.0 constraint does technically allow those.

    But that‘s almost never what the user wants. If their package doesn’t work with foo 2.0.0, it's certainly not likely to work with experimental, unstable versions of 2.0.0's API, which is what pre-release versions represent.

    To handle that, < version ranges don't allow pre-release versions of the maximum unless the max is itself a pre-release, or the min is a pre-release of the same version. In other words, a <2.0.0 constraint will prohibit not just 2.0.0 but any pre-release of 2.0.0. However, <2.0.0-beta will exclude 2.0.0-beta but allow 2.0.0-alpha. Likewise, >2.0.0-alpha <2.0.0 will exclude 2.0.0-alpha but allow 2.0.0-beta.

  • Pre-release versions are avoided when possible. The above case handles pre-release versions at the top of the range, but what about in the middle? What if “foo” has these versions:

    • 1.0.0
    • 1.2.0-alpha
    • 1.2.0
    • 1.3.0-experimental

    When a number of versions are valid, pub chooses the best one where “best” usually means “highest numbered”. That follows the user‘s intuition that, all else being equal, they want the latest and greatest. Here, that would mean 1.3.0-experimental. However, most users don’t want to use unstable versions of their dependencies.

    We want pre-releases to be explicitly opt-in so that package consumers don't get unpleasant surprises and so that package maintainers are free to put out pre-releases and get feedback without dragging all of their users onto the bleeding edge.

    To accommodate that, when pub is choosing a version, it uses priority order which is different from strict comparison ordering. Any stable version is considered higher priority than any unstable version. The above versions, in priority order, are:

    • 1.2.0-alpha
    • 1.3.0-experimental
    • 1.0.0
    • 1.2.0

    This ensures that users only end up with an unstable version when there are no alternatives. Usually this means they‘ve picked a constraint that specifically selects that unstable version -- they’ve deliberately opted into it.

  • There is a notion of compatibility between pre-1.0.0 versions. Semver deems all pre-1.0.0 versions to be incompatible. This means that the only way to ensure compatibility when depending on a pre-1.0.0 package is to pin the dependency to an exact version. Pinned version constraints prevent automatic patch and pre-release updates. To avoid this situation, pub defines the “next breaking” version as the version which increments the major version if it's greater than zero, and the minor version otherwise, resets subsequent digits to zero, and strips any pre-release or build suffix. For example, here are some versions along with their next breaking ones:

    0.0.3 -> 0.1.0 0.7.2-alpha -> 0.8.0 1.2.3 -> 2.0.0

    To make use of this, pub defines a “^” operator which yields a version constraint greater than or equal to a given version, but less than its next breaking one.