The pubspec.lock should be tracked in the repo.

It is useful to assure, all people have the same versions of all dependencies.