[mohammadfawaz]

Leo automatically records network editions, checksums, and Git commits in leo.lock. No manual checksum entry is needed. The program.json format stays the same.

Add and build dependencies

• Add: leo add token.aleo --network checks the program and writes its manifest entry, locked edition, and checksum.
• Build: leo build creates missing locks. If it locks edition 3 and edition 4 is later deployed, builds, runs, and tests still use edition 3.
• Fix an edition: leo add token.aleo --edition 3 requires edition 3, including during updates. Use leo add token.aleo --edition 4 to change it.
• Add Git: leo add my_library --git https://github.com/example/my_library --branch main locks a commit. Builds keep it when the branch changes and restore missing checkouts. leo build --offline requires a cached Git checkout.

Update dependencies explicitly

• Update all: leo update selects newer eligible network editions and Git branch commits across the project or workspace, including development and transitive dependencies. Only the lock changes.
• Update one: leo update token.aleo preserves unrelated versions where possible. Git packages sharing a repository and reference move together. Exact editions, Git revisions, and locked tags stay fixed.
• Preview: leo update token.aleo --dry-run shows changes without writing them. Failed updates leave the existing lock unchanged.
• Select a network: leo update --network mainnet updates mainnet entries; testnet entries stay separate.

Other user flows

• Download again: leo build --no-cache checks a fresh download against the locked edition and checksum. A mismatch fails; neither this flag nor leo update can replace an existing edition’s checksum.
• Remote commands: leo execute, leo deploy, leo synthesize, and standalone files use project pins when available. Outside a project, no supplied lock is needed. leo upgrade checks the current deployed root edition and keeps dependency pins.
• Existing projects: Version 1 Git locks remain readable. leo remove my_library removes its Git pins. credits.aleo uses bundled snarkVM bytecode regardless of its manifest edition and needs no network lock entry.
• Install Leo: The Leo/plugin self-updater and release notices are removed. Use the installation guide. Remove --disable-update-check from scripts; for example, use leo build.

This follows Cargo's manifest and lockfile model and explicit updates. Leo editions remain exact requirements; this does not add version ranges or Cargo's full option set.

Trust limit: The first download trusts the configured endpoint after ID and size checks. Old cache contents cannot establish the first checksum. This detects later changes, not a malicious first response, and partially addresses Zkao ZK-96f521d7.

Closes #28591 (automatic dependency locks and explicit updates).
Closes #29463 (broken self-updater removed).
Closes #29282 (self-update code and dependencies removed).
Closes #28444 (obsolete Updater removed).

Also addresses the checksum portion of #28480, the self-update removal in #29337, and part of the package and CLI coverage tracked in #28590 and #29041. These broader issues remain open.