The second solution is best since it allows to enhance the route to update something else (eg: tracker description, fields, …) later.

If you just want to change dependencies in this contribution, then you have to restrict your json to workflow/rules/list:

{
  "worflow": {
    "rules": {
      "lists": [
        …
      }
    }
  }
}

That way the user of the API does not think that she can update the whole workflow.

Yes, if I use the Patch /trackers/{id} route, should I specify in an parameter that I'm only updating the dependencies part of the tracker and then send in the body of the request the array of the rules that I have to update e.g :

[
{ "source_field_id": 477, "source_value_id": 100, "target_field_id": 478, "target_value_id": 367 },
{ "source_field_id": 477, "source_value_id": 362, "target_field_id": 478, "target_value_id": 366 },
{ "source_field_id": 477, "source_value_id": 363, "target_field_id": 478, "target_value_id": 365 },
{ "source_field_id": 477, "source_value_id": 364, "target_field_id": 478, "target_value_id": 100 }
]

or simply send the rules in their "json hierarchy" in the tracker which is workflow > rules > lists, so the previous rules update example will be sent in the body as a string like this:

"workflow": {
"field_id": 243,
"rules": {
"dates": [],
"lists": [
{
"source_field_id": 477,
"source_value_id": 100,
"target_field_id": 478,
"target_value_id": 367
},
{
"source_field_id": 477,
"source_value_id": 362,
"target_field_id": 478,
"target_value_id": 366
},
{
"source_field_id": 477,
"source_value_id": 363,
"target_field_id": 478,
"target_value_id": 365
},
{
"source_field_id": 477,
"source_value_id": 364,
"target_field_id": 478,
"target_value_id": 100
}
]
}

dependencies are part of /trackers/:id resource, therefore you have to patch /trackers/:id instead of creating a new resource.

Instead of "PUT /trackers/{id}/dependencies" I will use the "PATCH /trackers/{id}/dependencies" route and since I'm only updating the field dependencies of the tracker I added "/dependencies" subroute.

Since field dependencies are part of the tracker structure which is returned by GET /trackers/:id, you should use the resource /trackers/:id instead of creating a new one (/trackers/:id/dependencies is not a sub-resource of /trackers/:id).

Therefore you must define PUT or PATCH /trackers/:id. PUT will require to be able to change the whole structure of a tracker. PATCH allows to change only part of the resource, which seems to correspond to your need.