secure_pubspec_urls

The '{0}' protocol shouldn't be used because it isn't secure.

The analyzer produces this diagnostic when a URL in a pubspec.yaml file is using a non-secure scheme, such as http.

The following code produces this diagnostic because the pubspec.yaml file contains an http URL:

dependencies:
  example: any
    repository: http://github.com/dart-lang/example

Change the scheme of the URL to use a secure scheme, such as https:

dependencies:
  example: any
    repository: https://github.com/dart-lang/example

Unless stated otherwise, the documentation on this site reflects Dart 3.8.1. Page last updated on 2025-05-08. View source or report an issue.