Check out Nix (https://nixos.org https://nixos.org) which is designed around exactly this model. It works by putting the package hash into the path that you ac

Check out Nix (https://nixos.org https://nixos.org) which is designed around exactly this model. It works by putting the package hash into the path that you access the package by and hardcoding the path in all dependencies. This way every package has a hardcoded version as a dependency, however updating dependencies, even indirect ones is doable. However, the thing that’s lacking in typical use is granular updating of dependencies. By default you update sources independently, however the biggest source (nixpkgs) is a monorepo providing most major software. You can always figure out which version things have updated to and manually audit and pin the versions you don’t want and there is some tooling (not in Nix itself, but a 3rd party package) that does this.