It depends on the form. A registry name with an exact version or a Git URL pinned to a tag is reproducible. A name with no version, or a URL that points at a branch archive such as master, can resolve to different code on different days and does not make a reliable SBOM entry.
What lib_deps accepts
The PlatformIO documentation for the lib_deps option shows several ways to declare a library. You can use an owner based declaration from the registry, an external Git resource such as a repository URL with a fragment like a version tag, or a name mapped to an archive URL, for example a zip of a branch.
All of them work. They differ in how much they tell you about what was built.
Pinned versus floating
| Form | Reproducible? | Notes |
|---|---|---|
| Registry name with an exact version | Yes | Version recorded in the project file |
| Registry name with a range or no version | No | Resolves to whatever is newest within the range |
| Git URL with a tag fragment | Mostly | Tags can be moved, so prefer a commit |
| Git URL with a commit hash | Yes | Strongest of the Git forms |
| Archive URL of a branch such as master | No | Content changes with every push |
Check the exact syntax for your PlatformIO version in its documentation, since the supported fragment forms are described there.
Steps to tighten a project
- List every lib_deps line in every environment of your project file. Different environments often carry different libraries.
- Replace ranges with exact versions where the registry supports it.
- For Git dependencies, move from a tag to a commit hash.
- Replace branch archives with a tagged or hashed source, or vendor the library into your repository after review.
- Record the resolved version of each library in your build log so it reaches the SBOM.
Recording them in the SBOM
For each library, record name, exact version, where it came from, and a hash of the source if you can compute one. For libraries with no version at all, say so rather than inventing one. An honest unknown entry tells a reader that a manual check is needed.
Also record the framework and platform packages the build uses, such as the board support package. They are code too, and they have advisories.
Common questions from customers
Reviewers often ask whether a firmware build is repeatable. Pinned lib_deps entries are a concrete answer. Floating ones are the first thing a careful reviewer will flag.
Where Safeguard fits
Safeguard scans dependency manifests and generates SBOMs. PlatformIO project files are a specific format, so test a free scan on your repository and check what it reports for embedded libraries before relying on it.
Quick check
Is a Git tag a safe pin?
Safer than a branch, but a tag can be moved. A commit hash is stronger.
Should I vendor libraries into the repository?
It is a reasonable choice for critical libraries, as long as you record the upstream version and keep watching advisories.
Sources
Last reviewed: 19 October 2026.
