dart-lang · isoos · Oct 22, 2025 · Oct 22, 2025
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,8 +2,9 @@ Important changes to data models, configuration, and migrations between each
 AppEngine version, listed here to ease deployment and troubleshooting.
 
 ## Next Release (replace with git tag when deployed)
- * Bump runtimeVersion to `2025.10.21`.
+ * Bump runtimeVersion to `2025.10.22`.
  * Upgraded stable Flutter analysis SDK to `3.35.6`.
+ * Upgraded pana to `0.23.0`.
 
 ## `20251017t101000-all`
  * Bump runtimeVersion to `2025.10.17`.

diff --git a/app/lib/fake/backend/fake_pana_runner.dart b/app/lib/fake/backend/fake_pana_runner.dart
@@ -99,7 +99,7 @@ Future<Summary> fakePanaSummary({
         .where((url) => fakeUrlCheck('funding', url) != null)
         .toList(),
     contributingUrl: contributingUrl,
-    licenses: [License(path: '', spdxIdentifier: licenseSpdx)],
+    licenses: [License(spdxIdentifier: licenseSpdx)],
   );
   return Summary(
     createdAt: clock.now().toUtc(),
@@ -156,7 +156,6 @@ Future<Summary> fakePanaSummary({
       ],
     ),
     result: result,
-    licenses: [],
     errorMessage: null,
     pubspec: null, // will be ignored
   );

diff --git a/app/lib/fake/backend/fake_pub_worker.dart b/app/lib/fake/backend/fake_pub_worker.dart
@@ -337,8 +337,6 @@ Summary _emptySummary(String package, String version) {
     tags: null,
     report: null,
     result: null,
-    licenseFile: null,
-    licenses: null,
     errorMessage: null,
     pubspec: null, // will be ignored
   );

diff --git a/app/lib/frontend/templates/views/pkg/info_box.dart b/app/lib/frontend/templates/views/pkg/info_box.dart
@@ -43,7 +43,7 @@ d.Node packageInfoBoxNode({
   if (data.versionInfo.hasLicense) {
     final licenses = data.scoreCard.panaReport?.licenses ?? <License>[];
     if (licenses.isEmpty) {
-      licenses.add(License(path: 'LICENSE', spdxIdentifier: 'unknown'));
+      licenses.add(License(spdxIdentifier: 'unknown'));
     }
     license = _licenseNode(
       licenses: licenses,

diff --git a/app/lib/scorecard/models.dart b/app/lib/scorecard/models.dart
@@ -140,7 +140,7 @@ class PanaReport {
       }.toList(),
       allDependencies: summary?.allDependencies,
       // ignore: deprecated_member_use
-      licenses: summary?.result?.licenses ?? summary?.licenses,
+      licenses: summary?.result?.licenses,
       report: summary?.report,
       result: summary?.result,
       urlProblems: summary?.urlProblems,

diff --git a/app/lib/shared/versions.dart b/app/lib/shared/versions.dart
@@ -24,7 +24,7 @@ final RegExp runtimeVersionPattern = RegExp(r'^\d{4}\.\d{2}\.\d{2}$');
 /// when the version switch happens.
 const _acceptedRuntimeVersions = <String>[
   // The current [runtimeVersion].
-  '2025.10.21',
+  '2025.10.22',
   // Fallback runtime versions.
   '2025.10.17',
   '2025.10.10',

diff --git a/app/lib/tool/test_profile/resolver.dart b/app/lib/tool/test_profile/resolver.dart
@@ -64,7 +64,11 @@ Future<List<ResolvedVersion>> resolveVersions(
           ),
         );
 
-        final pr = await toolEnv.runUpgrade(dummyDir.path, false);
+        final pr = await toolEnv.runPub(
+          dummyDir.path,
+          command: 'upgrade',
+          usesFlutter: false,
+        );
         if (pr.exitCode != 0) {
           throw Exception(
             'dart pub get on `${package.name} $version` exited with ${pr.exitCode}.\n${pr.stderr}',

diff --git a/app/pubspec.yaml b/app/pubspec.yaml
@@ -46,7 +46,7 @@ dependencies:
   watcher: ^1.0.0
   yaml: ^3.1.0
   # pana version to be pinned
-  pana: '0.22.24'
+  pana: '0.23.0'
   # 3rd-party packages with pinned versions
   mailer: '6.5.0'
   postgres: '3.5.8'

diff --git a/app/test/dartdoc/dartdoc_page_test.dart b/app/test/dartdoc/dartdoc_page_test.dart
@@ -70,7 +70,7 @@ void main() {
         dartdocVersion: dartdocVersion,
         pubCacheDir: pubCacheDir,
       );
-      await toolEnv.runUpgrade(pkgDir, false);
+      await toolEnv.runPub(pkgDir, command: 'get', usesFlutter: false);
     });
 
     tearDownAll(() async {

diff --git a/pkg/pub_worker/pubspec.yaml b/pkg/pub_worker/pubspec.yaml
@@ -10,7 +10,7 @@ dependencies:
   appengine: ^0.13.6
   json_annotation: ^4.3.0
   jsontool: ^2.0.0
-  pana: ^0.22.24
+  pana: ^0.23.0
   path: ^1.8.0
   lints: ^6.0.0 # required for pana
   meta: ^1.7.0

diff --git a/pubspec.lock b/pubspec.lock
@@ -621,10 +621,10 @@ packages:
     dependency: transitive
     description:
       name: pana
-      sha256: bbad5a3e085fcc2475f08fe1240041e25d74482da80d9af00bc17cce99989e29
+      sha256: c6a2c709b7e1e3ca7f78fdf115adc651c8f08154f3abde59534fc4abbdc69872
       url: "https://pub.dev"
     source: hosted
-    version: "0.22.24"
+    version: "0.23.0"
   path:
     dependency: transitive
     description: