Locking julia dependencies

[MilesCranmer]

It would be nice to have an automatic way of locking Julia dependencies when releasing Python wheels, partly to minimize supply chain risks for users, and partly so that I can be confident there won't be bugs showing up. There are various tradeoffs, of course, but it might be nice to have a mechanism for this, similar to uv.lock.

[MilesCranmerBot]

Some design notes on this (from discussion with Miles).

A hard lock (shipping a Manifest.toml in the wheel and instantiating it) doesn't compose: juliapkg merges deps from every installed Python package into one shared Julia environment, so if two packages each ship a manifest, only one can win. Whatever mechanism this is, it has to degrade gracefully in the multi-package case.

Proposed shape, as a juliapkg feature:

1. A generated snapshot of the resolved closure, plain name -> version pairs, e.g. juliapkg.pinned.json next to juliapkg.json. Produced by a new python -m juliapkg freeze, meant to be run in CI after integration tests pass, so shipped versions are exactly the tested ones.
2. Seeded resolution. When snapshots are present, juliapkg first adds the pinned versions exactly, then adds remaining deps with Pkg.add(...; preserve=PRESERVE_TIERED). Non-conflicting deps stay pinned; shared deps relax only under actual conflict, with a warning listing what was relaxed. Multiple snapshots union their seeds, so two Julia-backed packages coexist and each keeps its pins wherever compatible.
3. No hashes needed. Pkg already verifies the registry's git-tree-sha1 on every download, so version pins inherit content integrity from the registry.

Supply-chain motivation: PySR has ~150 transitive Julia deps, i.e. hundreds of maintainer accounts whose next release currently auto-propagates to all users at install time. Published registry versions are effectively immutable (changing a recorded tree hash requires a registry PR), so the realistic attack vector is a malicious new release. A frozen closure closes exactly that window, and each release of the Python package then carries a reviewable diff of version bumps.

Behavior is unchanged when no snapshot exists. Implementation is small: a freeze subcommand plus a two-phase add in deps.py's resolve.

[MilesCranmerBot]

Implementation of the above: JuliaPy/pyjuliapkg#94