On first glance this looks similar to a pubspec.yaml file in Dart. Maybe you could borrow ideas from there.

It seems like for a business you'd also want to download your dependencies and check them in, in case the original repo isn't available.