`depend_on_referenced_packages` lint false positive in workspace

[arefimenko]

Steps:

1. create pub workspace relative to documentation https://dart.dev/tools/pub/workspaces
2. add dependency (or dev_dependency) into root pubspec.yaml
3. add depend_on_referenced_packages lint into root analysis_options.yaml
4. try to use added dependency in workspace package/project

Expected behaviour: static analysis DOES NOT show info message depend_on_referenced_packages
Actual behaviour: static analysis SHOWS info message depend_on_referenced_packages

Repository example: https://github.com/arefimenko/dart_workspace, file with analysis hint – https://github.com/arefimenko/dart_workspace/blob/main/pkgs/core/lib/src/core_base.dart

Dart version: Dart SDK version: 3.6.0 (stable) (Thu Dec 5 07:46:24 2024 -0800) on "macos_arm64"

[Levi-Lesches]

I'm fairly certain that the expected behavior is to also add the dependency to your sub-package's pubspec.yaml.

It's true that the entire workspace shares dependencies, but the collection of "workspace dependencies" is simply the sum of all the sub-packages' dependencies. For example, consider:

workspace/
  pkg1/
  pkg2/

If pkg1 depends on dependency, then it's technically true that pkg2 can access it without including it in its pubspec. But that means pkg1 is now tied to pkg2 in some non-intuitive ways. If someone changes pkg1 that makes it no longer depend on dependency, now pkg2 is broken!

The point of the lint, as I see it, is that you should make all packages self-contained -- a reader should be able to understand what each package does by reading it independently, and users should be able to use just one package in the workspace. It seems you're using workspaces to mean "only declare dependencies at the root instead of in each package", but that would go against how packages are currently treated in the ecosystem.

So I think the current behavior is the expected one, and you should include your dependencies in the pubspec.yaml of each package that needs it, and let Pub do the rest.

[PiotrRogulski]

So I think the current behavior is the expected one, and you should include your dependencies in the pubspec.yaml of each package that needs it, and let Pub do the rest.

This behavior does make sense, but I think that (at least for non-package projects, like apps) having common dependencies, available for all sub-packages is useful.

For example, consider a Flutter project:

workspace/
  my_app/
  my_app_ds/
  my_app_core/

All of these packages depend on flutter_hooks. This forces me to specify flutter_hooks: ^0.21.2 three times, which makes upgrading this dependency tedious.

Instead, it would be nice to specify it once in the root, e.g.:

common_dependencies: # or workspace_dependencies?
  flutter_hooks: ^0.21.2