The last pure-local check in the spec's table (dependency-unpinned, listed as "available, unmeasured"). Stacked on #559.

A notebook is only reproducible as far as its dependencies are. pandas>=2.0 resolved to 2.0.1 the day it was written and resolves to something else now, so a notebook that ran then and fails now has no diff to blame. That is the specific failure that makes people stop trusting a workspace.

Three sources

A .deepnote project can declare a dependency in three places, and only one of them appears in any inventory built from the file:

The third is the interesting one: it runs every time the notebook does, and it is usually how a dependency enters a workspace without anyone deciding to add it.

The lockfile settles it, except where a block does not let it

This is the decision the check's precision rests on, and the first version got it wrong.

numpy>=1.24 in settings.requirements sitting beside numpy: 1.26.0 in environment.packages is reproducible — the lock is what installs. Treating "weakest declaration wins" as a flat rule fired on numpy and requests in the test fixture, and would fire on nearly every synced project, every time wrongly.

But !pip install numpy in a block runs after the environment is built, so it overrides the lock. That case is reported even though the package is locked, and the message says what the lock resolves to — because from the file alone it looks pinned.

On the fixture this is the difference between 8 findings (4 of them wrong) and 4 (all of them right).

Checks

The first two are per-file, so they work in CI through deepnote lint --governance — no workspace needed.

Drift counts maintained projects only. A notebook abandoned in 2021 pinning the version that was current in 2021 is pinning working as intended, not a team disagreeing with itself. Without this filter every package in every workspace that has ever had an old project in it gets a finding — in the fixture it was the difference between 7 findings and 4, and numpy correctly stops being reported at all. The old version still appears in the inventory; it just is not a dispute.

The SBOM is the deliverable

deepnote audit workspace --sbom > sbom.json

CycloneDX 1.5, which is what Grype and Trivy read. One component per package version, not per package: a workspace where two projects pin different versions genuinely contains both, and collapsing them into one versionless component would hide every advisory for both.

pkg:pypi/pandas@1.3.5   Legacy reporting
pkg:pypi/pandas@2.0.1   Growth activation, Marketing attribution, Revenue core
pkg:pypi/matplotlib     Marketing attribution      ← no version to match on; that is the finding

Also in here

• Parsing is PEP 508-ish and offline by design: extras, environment markers, comments, wildcards, VCS refs (pinned only at a commit, never at a branch), -r/--index-url flags skipped, quoted specifiers, and conda's single-= pin — which under pip grammar is not a specifier at all.
• A pluralisation bug from feat(cli): SQL divergence — integration-scoped, measurable, with optional local-model triage #559 (5 querys diverges).
• WorkspaceProject now carries the declared environment, unioned across a project's files so a partial checkout still sees the whole set.

Not built, and why

The two † checks in the spec — schema-broken-query and pii-column-flow — need GET /v2/integrations/:id for a cached column schema. There is no integrations API client in this repo, and AGENTS.md requires tests to avoid live network calls, so a speculative client for an endpoint I cannot verify against would be untested code in a compliance tool. They remain the biggest unlock and are the natural next PR once that endpoint is available. The audit and the docs both say this rather than implying coverage.

Verify

npx tsx packages/cli/src/bin.ts lint test-fixtures/governance-dependencies.deepnote --governance
npx tsx packages/cli/src/bin.ts audit test-fixtures/workspace-divergence --packages
npx tsx packages/cli/src/bin.ts audit test-fixtures/workspace-divergence --sbom

The lint fixture is built so the lockfile/requirements interaction is visible: numpy and requests are loose in requirements but locked, and stay silent; scikit-learn~=1.3 is not locked and fires; the two imperative installs fire for both codes.

56 new tests. pnpm test has one failure on every branch including main — run.test.ts > creates ExecutionEngine with correct config, a local python3 resolution quirk unrelated to this work.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • deepnote lint --governance now warns about unpinned dependencies and packages installed in notebook blocks but missing from the project environment. These warnings do not cause the command to fail.
  • deepnote audit now reports dependency inventory, pinning, and version drift across maintained projects, with dependency counts and project usage.
  • Use --packages to list all unpinned or drifted packages, or --sbom to export a CycloneDX 1.5 bill of materials with a component for each package version.
• Documentation
  • Clarified which dependency sources are checked and how lockfile versions and notebook installs affect results. The bill of materials covers direct dependencies only, without transitive resolution or network lookup.

Update: inherited from the branches below

No functional change on this branch beyond what the stack below it brought, but two of those changes land visibly here:

• The SBOM stopped being redacted. Once feat(cli): deepnote audit — workspace integration inventory, data flow map, and governance findings #556's redaction boundary covered the whole report, pkg:pypi/numpy@1.26.0 was masked — the version half matched the email-address pattern, whose domain arm allowed an all-numeric final label. A bill of materials naming components nothing can resolve defeats the point of emitting one. Fixed at its source on feat(cli): deepnote subjects — fingerprinted subject index and DSAR lookup #557 by requiring a letter-initial top-level domain.
• Dependency findings mask their block labels against the block, not against the label alone, matching how every other finding in the stack does it.