That only solves part of the problem. something like poetry's approach is the right one here; you need a list of core dependencies (not derived ones), you need

That only solves part of the problem. something like poetry's approach is the right one here; you need a list of core dependencies (not derived ones), you need a solver for when anything changes to find a new set of viable versions, and you need a lock file of some sort to uniquely & reproducible construct an environment.