Yes: the transitive dependencies is the big problem here, and a hard one to solve. I can handle direct dependencies manually, more or less, because that's the

Yes: the transitive dependencies is the big problem here, and a hard one to solve. I can handle direct dependencies manually, more or less, because that's the code I'm using directly and I know what are my requirements. But then I'm mostly clueless regarding dependencies of my dependencies, and if those aren't pinned by the project that is using them directly, all sort of bad things can happen. And this is why I love Linux distributions so much: they've been solving this problem for a long time. Whenever I can, between using upstream or a slightly older version maintained by my distro, I choose the latter.