A fast, Rust-powered dependency & build manager for Flutter.
Hatch reads a small manifest, resolves your full dependency graph from pub.dev with a parallel solver, slims every package on the way into a machine-global cache, and pins your Flutter SDK through FVM. One static binary, extensible through plugins.
Full pub.dev & FVM integration · Single static binary · MIT or Apache-2.0
One binary that resolves and builds.
The core does dependency resolution and toolchain management for any Flutter project. Everything else, including Mac-free iOS, is a plugin.
Resolve, slim, cache.
A parallel Rust resolver reads your manifest, solves the full graph, strips every package down to the code your build needs, and stores it in one machine-global cache that every project shares.
- Parallel PubGrub resolver
- File-purging debloat
- Machine-global cache
- SHA-256 verification
Pin, script, extend.
FVM keeps every machine on the same Flutter version, manifest scripts automate the busywork, and the plugin system layers on new capabilities – like building iOS without a Mac.
- FVM SDK pinning
- Project scripts
- Plugin system
- Reproducible builds
Fast because it does less work, in parallel.
Hatch is not fast just because it is written in Rust. The speed comes from skipping work that does not need doing and splitting the rest across threads.
Reproducible micro-benchmarks live in the repo under benches/. They are synthetic fixtures on a warm cache, not marketing numbers – run them on your own hardware.
-
01
Manifest-hash cache
Every resolve hashes the manifest first. If nothing changed, the previous version map is returned with no solver and no network at all.
-
02
Interval propagation
A top-down propagator narrows each package's range before the SAT solver runs. In the common conflict-free case the full solve is skipped entirely.
-
03
Parallel metadata
Version metadata for every package is fetched concurrently behind a semaphore, and anything already cached is served locally with no round-trip.
-
04
Independent subgraphs
The residual graph is split into connected components that provably cannot conflict, and each is solved on its own thread in parallel.
-
05
PubGrub for the rest
Whatever genuinely needs solving goes to a PubGrub solver, which also returns precise, human-readable conflict explanations.
Every package, slimmed on the way in.
Published Dart and Flutter packages ship things you never compile: example apps, test suites, generated docs, screenshots, CI config, editor folders. Hatch strips that as it extracts, so the cached tree is the code your build actually uses and nothing else.
Asset-aware
Reads the package pubspec and preserves whatever it actually declares – assets, fonts, and the real platform folders under flutter.plugin.platforms.
Per-package overrides
A package can ship a .hatch.json with keep / strip glob lists to fine-tune exactly what survives.
Always reversible
Set HATCH_DEBLOAT=0 to extract packages verbatim with no filtering. The kept list always wins over stripping.
- + lib/
- + bin/
- + pubspec.yaml
- + LICENSE
- + README.md
- − example/
- − test/
- − doc/
- − .github/
- − .vscode/
- − screenshots/
- − banner.psd
One cache per machine. Verified every time.
Machine-global cache
Download and unpack a package once; every project on the machine reuses it.
- Global & shared
- One debloated copy of http 1.2.0 serves every project, not one per checkout.
- Relocatable
- Point HATCH_CACHE_DIR at any path – handy for CI restore or a shared volume.
- Self-maintaining
- Metadata expires after 7 days and is garbage-collected; prune --aggressive trims to lockfile versions.
Security by default
Nothing runs or installs without passing a check first.
- Mandatory checksums
- Every download must carry a checksum or the install aborts. Each bypass is written to the audit log.
- Trust on first use
- A dependency script prompts before its first run; the choice is remembered. CI defaults to deny.
- Audit log
- Every checksum bypass and trust decision is recorded under ~/.hatch for review.
What works today.
Hatch is open core and honest about its edges. Here is the real state of each area.
A toolchain, not a one-trick script.
Full pub.dev integration
Talks to the public pub.dev API as an ordinary client – resolves the full graph, honours version constraints, and writes a lockfile, no custom registry required.
Full FVM integration
First-class FVM support lists, installs, pins, and syncs Flutter SDKs so every machine and CI run is on the exact same version.
Single manifest
Declare dependencies, SDK constraints, scripts, and profiles in one hatch.json or hatch.yaml, and let the resolver lock and install them.
Path & git sources
Local path dependencies for monorepos work today; git dependencies are parsed and validated with resolution on the way.
Reproducible builds
Deterministic resolution and pinned tooling mean the build on your laptop matches the build in CI, byte for byte.
Extensible by plugins
Install plugins from the registry to add build targets and integrations – iOS being the flagship example.
The core, in one binary.
Global flags: -v / -vv / -vvv for verbosity, -q for quiet, --profile <name>, --project-dir <path>, --allow-unchecksummed. Plugins add their own subcommands once installed.
hatch init [name]- Scaffold a new project
hatch migrate- Convert pubspec.yaml to hatch.json
hatch install- Resolve + download + cache dependencies
hatch add <pkg> [ver]- Add a dependency (--dev for dev-only)
hatch remove <pkg>- Remove a dependency
hatch update [pkgs...]- Update some or all dependencies
hatch why <pkg>- Explain why a package is in the graph
hatch run <script>- Run a manifest script
hatch fvm <list|use|install|sync>- Manage Flutter SDKs via FVM
hatch sdk-update- Update Flutter / Dart constraints
hatch cache stats- Cache location, size, package count
hatch cache prune --aggressive- Re-apply debloat, trim to lockfile
hatch cache clear --force- Empty the machine-global cache
hatch plugin install <name>- Install a plugin from the registry
hatch plugin list- List installed plugins
hatch plugin remove <name>- Remove an installed plugin
Ship iOS without a Mac.
The ios plugin rebuilds every Apple-only step natively – the AOT compile, the Mach-O link, the icon catalog, the code signature, and the App Store Connect upload – so you build, sign, and ship to TestFlight from Linux or Windows. No Mac, no cloud Mac, no Xcode.
Extend Hatch with plugins.
Plugins add build targets, tools, and integrations on top of the core – the Mac-free iOS plugin is the flagship, but the registry is open. Install one command and Hatch fetches the right asset for your platform, checksum and all.
Private Nests
A self-hostable private registry for your team – one place to host private packages, publish patched forks under your own scope, and mirror pub.dev for fast, reproducible, air-gapped builds. The manifest already accepts and validates nest sources; resolution is on the roadmap.
Credentials live in a git-ignored hatch_auth.json or HATCH_NEST_* env vars, never in the manifest.
Get Hatch
Prebuilt binaries for Linux and Windows ship with every GitHub release. Pick your platform, drop it on your PATH, and run your first install.
Prefer to build from source? Clone the repository and run the standard Rust toolchain. cargo build --release
Resolve faster. Build anywhere.
Install Hatch and put a reproducible Flutter dependency and build pipeline on the machine in front of you.
Download Hatch