Analyze and report 'pub downgrade' issues.

[isoos]

• Flag incorrect lower bounds in pubspec.yaml #1356

[jonasfj]

I propose granted 20 points in the "Pass static analysis" section, as follows:

@mit-mit Any thoughts on giving 20 points when passing static analysis after dart pub downgrade. That's trying with a set of oldest versions that:

• Is allowed by constraints in pubspec.yaml, and,
• Is mutually compatible.

This effectively passing dart pub downgrade && dart analyze, do notice that downgrade will try to get an oldest set of versions, there may be multiple sets of oldest versions, and it may not be possible get oldest versions of some packages (due to incompatibilities, etc).

In an ideal world, we could prove that a package is compatible with the lower-bounds of its dependencies. This is an under-approximation such a test. But it's likely to catch a lot!

[jonasfj]

note: package authors can always fix this issue by running dart pub upgrade --tighten and republish a new version.

[isoos]

Note: I've left the subsection inside the up-to-date dependencies section and set 20 points for it.

[sigurdm]

It would be nice if we had an end2end example that actually triggers this (such that it resolves and has some analysis error that was not present in the upgraded static analysis...

[isoos]

Updated suggestion to "You may run dart pub upgrade --tighten to update your dependency constraints, or visit http://dart.dev/go/downgrade-testing for further help." PTAL.