The Manifest.toml file records the exact git tree hash of each dependency. In fact, in the most common usage, the package UUID and the git hash are how you find the code to load, so knowing exactly what code you’re running is inherently built into the code loading mechanism. You can also give an explicit path but that’s mostly only for using development versions and you can still snapshot the git tree hash of those as well.
1 Like