One possible issue is that compile or test time dependency resolution, especially for uncompiled languages, doesn’t distinguish betweeen explicit and transitive

One possible issue is that compile or test time dependency resolution, especially for uncompiled languages, doesn’t distinguish betweeen explicit and transitive dependencies in most package managers/build systems. If you have a direct source dependency, imho, it should be explicit (not relied on transitively), and if not (unless a specific runtime version is necessary), transitive dependencies should not be locked or specifically annotated in a lock file. The former is overly flexible, the latter overly rigid. I also prefer an external manifest that can lock specific versions of all dependencies, but that usually requires a separate package manager from the language provided one, which introduces a whole new set of issues.