check-in pubspec.yaml that refers to published packages only