To add to that, the suspicious steps are: manually adding root dependencies. What if you forget? Not locking. What if you forget? Locking invalid versions. W

To add to that, the suspicious steps are: manually adding root dependencies. What if you forget? Not locking. What if you forget? Locking invalid versions. What if you don't check all is compatible first? How do you handle dev requirements? requirements_dev? but then how do you lock? The good thing is: you got rid of dependency walking and slow locking. As with everything, there is a tradeoff that I was willing to take.