But to the GP’s point, this VM config is a program, so why are you expressing it as a static config file? The ending virtual machine will be valid as long as the steps involved in its creation are.
At least, not without restricting yourself to a tractable subset like dependabot does.