anchor.diff:        outOfDate();
       }
   
  +    // Check if language version specified in the `package_config.json` is
  +    // correct. This is important for path dependencies as these can mutate.
       for (final pkg in cfg.packages) {
         final id = lockFile.packages[pkg.name];
         if (id == null) {
  -        continue; // Ignore entries that aren't in the lockFile
  -      }
  -
  +        assert(
  +          false,
  +          'unnecessary package_config.json entries should be forbidden by '
  +          '_isPackagePathsMappingUpToDateWithLockfile',
  +        );
  +        continue;
  +      }
  +
  +      // If a package is cached, then it's universally immutable and we need
  +      // not check if the language version is correct.
         final source = cache.source(id.source);
         if (source is CachedSource) {
           continue;
         }
   
         try {
  +        // Load `pubspec.yaml` and extract language version to compare with the
  +        // language version from `package_config.json`.
           final languageVersion = extractLanguageVersion(
             cache.load(id).pubspec.sdkConstraints[sdk.identifier],
           );
  
positive.code:     });
    }
  
    /// Determines [lockfile] agrees with the given [packagePathsMapping].
    ///
    /// The [packagePathsMapping] is a mapping from package names to paths where
    /// the packages are located. (The library is located under
    /// `lib/` relative to the path given).
    bool _isPackagePathsMappingUpToDateWithLockfile(
            Map<String, String> packagePathsMapping) =>
        lockFile.packages.values.every((lockFileId) {
          // It's very unlikely that the lockfile is invalid here, but it's not
          // impossible—for example, the user may have a very old application
          // package with a checked-in lockfile that's newer than the pubspec, but
          // that contains SDK dependencies.
          if (lockFileId.source is UnknownSource) return false;
  
          final packagePath = packagePathsMapping[lockFileId.name];
          if (packagePath == null) {
            return false;
          }
  
          final source = cache.source(lockFileId.source);
          final lockFilePackagePath =
              p.join(root.dir, source.getDirectory(lockFileId));
  
          // Make sure that the packagePath agrees with the lock file about the
          // path to the package.
          if (p.normalize(packagePath) != p.normalize(lockFilePackagePath)) {
            return false;
          }
  
          // For cached sources, make sure the directory exists and looks like a
          // package. This is also done by [_arePackagesAvailable] but that may not
          // be run if the lockfile is newer than the pubspec.
          if (source is CachedSource && !dirExists(lockFilePackagePath) ||
              !fileExists(p.join(lockFilePackagePath, 'pubspec.yaml'))) {
            return false;
          }
  
          return true;
        });
  
    /// Checks whether or not the `.packages` file is out of date with respect
    /// to the [lockfile].
  
negative.code: 
      var touchedLockFile = false;
      if (lockFileModified.isBefore(pubspecModified) || hasPathDependencies) {
        // If `pubspec.lock` is newer than `pubspec.yaml` or we have path
        // dependencies, then we check that `pubspec.lock` is a correct solution
        // for the requirements in `pubspec.yaml`. This aims to:
        //  * Prevent missing packages when `pubspec.lock` is checked into git.
        //  * Mitigate missing transitive dependencies when the `pubspec.yaml` in
        //    a path dependency is changed.
        _assertLockFileUpToDate();
        if (_arePackagesAvailable()) {
          touchedLockFile = true;
  