Git Tags Aren't a Package Manager.

Every Dart team starts the same way: the shared package moves to its own repo, the pubspec grows a git: ref and it works. Then the second app appears, the second team, the first partner... and the easy solution breaks down. To be fair to path: dependencies inside one repo, with melos, they're great. The trouble starts when code crosses a repo, a team, or a company boundary. That's when tags fall apart:

• Share your packages, not your repo. There's no way to hand a customer a git dependency without handing them repo access. With Dartastic Pub you can allow access per-package, watch the access logs, and revoke access the moment the contract ends.
• No pub, no memory. Which internal packages exist? What changed in 2.3.0? Which version supports the new SDK? With git dependencies the answer lives in Slack. A pub registry renders READMEs, changelogs, and version history. New teammates browse instead of searching or asking.
• Your tooling goes blind. dart pub outdated and constraint-based upgrades reason over hosted version lists. Git refs are opaque to them. And packages published to pub.dev aren't allowed git dependencies at all, so internal shared code on git tags caps what you can ever ship publicly.
• Tags move. Archives don't. A tag can be force-pushed, a branch rewritten, a repo renamed, a commit garbage-collected. Your lockfile pins a commit hash, but nothing guarantees that commit stays fetchable. A published version on a registry is an immutable archive. The build that passed yesterday fetches the same bytes next year.
• Git dependencies are fat. Git fetches the entire history. Every branch, every experiment, every secret someone committed and "deleted" three years ago. A pub package ships the published files of one version. Nothing else.
• One ref is not version solving. A git dependency pins exactly one commit. The solver can't try other versions. The day one package needs shared_models at v2 while another still needs v1, resolution simply fails, and you're coordinating a lockstep upgrade across every consumer. A registry gives pub a version list, so ^1.2.0 constraints resolve the way they do on pub.dev. (Dart 3.9's tag_pattern can now feed tags to the solver, credit where due. Every problem below still stands.)
• Your lockfile is your bill of materials. An opinion we'll defend: pubspec.lock ships with the app. It is the BOM, the exact parts list of the build you released. With hosted dependencies, every entry carries a name, an exact version, and a sha256 of the archive. Auditors can verify it. You can rebuild from it. A git dependency's entry is a repo URL and a commit hash. There is no content hash of the package, and the pointer dangles the day history moves. Reviews suffer too. A hosted lock diff reads like "1.2.3 to 1.2.4", while a git lock diff swaps one forty-character hash for another. Nobody can tell a patch from a rewrite. And a checked-in lock can lull a team: one dev upgrades and forgets to commit, another pulls and skips pub get, and now two devs read the same pubspec while running different code. If the package is a library, consumers never see your lock at all. You tested a dependency set your users will never run.
• Pub clones the repository. All of it. Resolving a git dependency fetches the repo, history included, to deliver one package. A hosted dependency downloads one small archive of one version, cached. Your CI feels the difference on every fresh run.
• dart pub publish is a quality gate. A tag is not. Publishing validates the version bump, the changelog, the analysis; releasing is a deliberate act. Anyone can tag anything, including broken code and a pubspec whose version disagrees with the tag name.

dependencies:
  shared_models:
    git:
      url: git@github.com:acme/shared_models.git
      ref: v1.2.0   # repo creds required,
                    # no ranges, tag can move

dependencies:
  shared_models:
    hosted: https://pub.dartastic.io
    version: ^1.2.0   # per-package token,
                      # immutable archives

Even Dart's own documentation points teams at a package repository for collaborative work. Dartastic Pub is that repository, minus the running of it. Start free. Outgrow it for the price of a coffee.