Because some guy in some library used by a library in an SDK I use didn't set a fixed version for his dependency which has been updated and has a serious bug in

Because some guy in some library used by a library in an SDK I use didn't set a fixed version for his dependency which has been updated and has a serious bug in it... My app isn't working. Now I have to go through my requirements and set the exact versions that worked last time we released, have an enormous requirements file, and I'll probably never touch it again and have stale dependencies. Yeah... I don't like pip