Yes, exactly. And how many of these projects go to any effort to pin their transitive dependencies? In my experience, this is basically no one; in fact I've se

Yes, exactly. And how many of these projects go to any effort to pin their transitive dependencies? In my experience, this is basically no one; in fact I've seen many (most?) projects not even pin the versions on their top-level dependencies. (Ask yourself how many times you've seen just "numpy" as a dependency without any version bound. Far too often in my experience.) And this is exactly why stuff breaks: even when the root dependencies are pinned (and are they?), a transitive dependency could get upgraded and break something (or fail to build entirely).