There's a new (optional) top-level pubspec.yaml entry that will be needed for some of our plugins (more precisely, some of their examples):

false_secrets

Here's the incoming documentation:

• Documenting false_secrets in pubspec.yaml dart-lang/site-www#3409

The script that (maybe) will start barking once we start using the new entry is pubspec_check_command.dart (here).

(I've been affected by the lack of this new entry in this PR, I'd expect this validation to hit any example apps that use API keys: google sign in, maps, iap (?)...)