什么是 pubspec.lock

A file named pubspec.lock that specifies the concrete versions and other identifying information for every immediate and transitive dependency a package relies on.

Unlike the pubspec, which only lists immediate dependencies and allows version ranges, the lock file comprehensively pins down the entire dependency graph to specific versions of packages. A lockfile ensures that you can recreate the exact configuration of packages used by an application.

The lockfile is generated automatically for you by pub when you run pub get, pub upgrade, or pub downgrade. If your package is an application package, you will typically check this into source control. For library packages, you usually won’t.

意思是

。。。

pubspec.lock的文件定义包所依赖的每个直接依赖项和间接依赖项的具体版本和其他标识信息

pubspec只列出直接依赖项和允许版本的范围，与pubspec不同，pubspec.lock文件全面地将整个依赖项对应到包的特定版本。
pubspec.lock确保您可以重新创建应用程序使用的包的准确。

当您运行pub get、pub升级或pub降级时，pub会自动为您生成lockfile。
如果您的包是一个应用程序包，您通常会将其签入源代码控制。对于库包，通常不会这样做。