Upgrade pana to 0.23.0 (#9028)

Author: isoos

CHANGELOG.md

@@ -2,8 +2,9 @@ Important changes to data models, configuration, and migrations between each
 AppEngine version, listed here to ease deployment and troubleshooting.
 
 ## Next Release (replace with git tag when deployed)
- * Bump runtimeVersion to `2025.10.21`.
+ * Bump runtimeVersion to `2025.10.22`.
  * Upgraded stable Flutter analysis SDK to `3.35.6`.
+ * Upgraded pana to `0.23.0`.
 
 ## `20251017t101000-all`
  * Bump runtimeVersion to `2025.10.17`.

app/lib/fake/backend/fake_pana_runner.dart

@@ -99,7 +99,7 @@ Future<Summary> fakePanaSummary({
         .where((url) => fakeUrlCheck('funding', url) != null)
         .toList(),
     contributingUrl: contributingUrl,
-    licenses: [License(path: '', spdxIdentifier: licenseSpdx)],
+    licenses: [License(spdxIdentifier: licenseSpdx)],
   );
   return Summary(
     createdAt: clock.now().toUtc(),
@@ -156,7 +156,6 @@ Future<Summary> fakePanaSummary({
       ],
     ),
     result: result,
-    licenses: [],
     errorMessage: null,
     pubspec: null, // will be ignored
   );

app/lib/fake/backend/fake_pub_worker.dart

@@ -337,8 +337,6 @@ Summary _emptySummary(String package, String version) {
     tags: null,
     report: null,
     result: null,
-    licenseFile: null,
-    licenses: null,
     errorMessage: null,
     pubspec: null, // will be ignored
   );

app/lib/frontend/templates/views/pkg/info_box.dart

@@ -43,7 +43,7 @@ d.Node packageInfoBoxNode({
   if (data.versionInfo.hasLicense) {
     final licenses = data.scoreCard.panaReport?.licenses ?? <License>[];
     if (licenses.isEmpty) {
-      licenses.add(License(path: 'LICENSE', spdxIdentifier: 'unknown'));
+      licenses.add(License(spdxIdentifier: 'unknown'));
     }
     license = _licenseNode(
       licenses: licenses,

app/lib/scorecard/models.dart

@@ -140,7 +140,7 @@ class PanaReport {
       }.toList(),
       allDependencies: summary?.allDependencies,
       // ignore: deprecated_member_use
-      licenses: summary?.result?.licenses ?? summary?.licenses,
+      licenses: summary?.result?.licenses,
       report: summary?.report,
       result: summary?.result,
       urlProblems: summary?.urlProblems,

app/lib/shared/versions.dart

@@ -24,7 +24,7 @@ final RegExp runtimeVersionPattern = RegExp(r'^\d{4}\.\d{2}\.\d{2}$');
 /// when the version switch happens.
 const _acceptedRuntimeVersions = <String>[
   // The current [runtimeVersion].
-  '2025.10.21',
+  '2025.10.22',
   // Fallback runtime versions.
   '2025.10.17',
   '2025.10.10',

app/lib/tool/test_profile/resolver.dart

@@ -64,7 +64,11 @@ Future<List<ResolvedVersion>> resolveVersions(
           ),
         );
 
-        final pr = await toolEnv.runUpgrade(dummyDir.path, false);
+        final pr = await toolEnv.runPub(
+          dummyDir.path,
+          command: 'upgrade',
+          usesFlutter: false,
+        );
         if (pr.exitCode != 0) {
           throw Exception(
             'dart pub get on `${package.name} $version` exited with ${pr.exitCode}.\n${pr.stderr}',

app/pubspec.yaml

@@ -46,7 +46,7 @@ dependencies:
   watcher: ^1.0.0
   yaml: ^3.1.0
   # pana version to be pinned
-  pana: '0.22.24'
+  pana: '0.23.0'
   # 3rd-party packages with pinned versions
   mailer: '6.5.0'
   postgres: '3.5.8'

app/test/dartdoc/dartdoc_page_test.dart

@@ -70,7 +70,7 @@ void main() {
         dartdocVersion: dartdocVersion,
         pubCacheDir: pubCacheDir,
       );
-      await toolEnv.runUpgrade(pkgDir, false);
+      await toolEnv.runPub(pkgDir, command: 'get', usesFlutter: false);
     });
 
     tearDownAll(() async {

pkg/pub_worker/pubspec.yaml

@@ -10,7 +10,7 @@ dependencies:
   appengine: ^0.13.6
   json_annotation: ^4.3.0
   jsontool: ^2.0.0
-  pana: ^0.22.24
+  pana: ^0.23.0
   path: ^1.8.0
   lints: ^6.0.0 # required for pana
   meta: ^1.7.0