refering to the officiel docummentaion here
this is the answer :
When pub get gets new dependencies, it writes a lockfile to ensure that future gets will use the same versions of those dependencies. Application packages should check in the lockfile to source control; this ensures the application will use the exact same versions of all dependencies for all developers and when deployed to production. Library packages should not check in the lockfile, though, since they’re expected to work with a range of dependency versions.
If a lockfile already exists, pub get uses the versions of dependencies locked in it if possible. If a dependency isn’t locked, pub gets the latest version of that dependency that satisfies all the version constraints.