Dependencies

joy supports direct dependencies from multiple source backends and uses lockfile provenance to keep resolution deterministic.

Supported Direct Source Backends

• github
• registry
• git
• path
• archive

See Dependency Source Backends for user workflows and Manifest Schema for field-level contract details.

Source-Aware Update Reporting

joy outdated --sources supports:

• all (default)
• registry
• github
• git
• path
• archive

Provenance + Integrity

joy.lock records source provenance fields used by:

• joy verify
• joy vendor
• offline/frozen dependency reuse

See Lockfile Schema.