Agreed, or if you dont, you should run pip-compile during CI/merge in order to pin every dependency in the entire tree. These are very solveable (and have been

Agreed, or if you dont, you should run pip-compile during CI/merge in order to pin every dependency in the entire tree. These are very solveable (and have been solved for a while) problems. It really pains me that most people are either unaware or do not dive deep enough below the surface to find them.