How to add variance: add dependency-drift grouping

- Dependencies listed in your project

### Lockfiles

### Preventing dependency drift

#### Lockfiles

Some build systems (Go, Cargo, NPM...) allow you to include the exact version of your dependencies.

Whenever possible, you should version it or include it in your source tarballs, so that people will be able to use them to recreate a similar environment to you.

### Vendored dependencies

#### Vendored dependencies

Another possibility is to include a copy of your dependencies in your source tree, or to reference it with similar methods, such as git submodules.

### Debian Snapshots

#### Debian Snapshots

Debian packages must be reproducible with the packages that were available in the archive when they were built.