endor-dependency-provenance

To trace dependency provenance, group by package coordinate, manifest file path, and source ref or sha to produce path-specific evidence showing exactly where a package version was introduced.

Multiple package versions appear across lockfiles and branches because they are introduced through distinct manifest paths; grouping by dependency file path and source ref separates each provenance path without merging them.

Direct versus transitive dependency analysis distinguishes whether a package was introduced explicitly in the manifest or inherited transitively through another dependency, producing a path-by-path matrix with parent package details.

Dependency lineage applies across different commit snapshots and source refs by requiring grouping by package coordinate, dependency file path, and source ref or sha to produce path-specific provenance evidence for each commit.

The best way to investigate duplicate package versions is to resolve package-version lineage by manifest path and source ref, separating direct from transitive introduction paths to prevent incorrect rollups that hide provenance.

You should not roll up duplicate dependency versions when the same package appears through multiple manifests, refs, or commit shas, as merging hides whether a package was introduced directly or transitively.