keptdepends

Keptdepends is a conceptual approach to managing software dependencies that focuses on maintaining a persistent, auditable record of a project’s dependency graph across builds and environments. It defines a manifest and lock mechanism designed to promote reproducible builds, stability, and transparency in software supply chains.

In practice, keptdepends operates alongside existing package managers. A typical workflow includes declaring dependencies in a keptdepends manifest (for example, keptdepends.yaml), resolving the graph to concrete versions, and generating a lockfile (keptdepends.lock) that captures the exact resolved graph. During installation, the lockfile is applied to ensure identical results across machines and environments. The system supports version constraints, multiple ecosystems, and environment-specific overrides.

Key features include immutability of the resolved dependency graph, provenance metadata for each dependency, and modes that prioritize near-deterministic or fully deterministic resolutions. Keptdepends also provides adapters to integrate with common build tools and package ecosystems, enabling seamless adoption without discarding existing workflows. Additional tooling supports auditing changes to dependencies, historical provenance, and integration with vulnerability databases for ongoing security governance.

Limitations include adoption overhead, the risk of stale lockfiles if not refreshed, and the need for robust tooling to maintain cross-ecosystem compatibility. As a conceptual framework, keptdepends aims to complement traditional lockfiles by emphasizing long-term stability, traceability, and governance of dependencies across software projects.