> That's quite literally not the design, if by "dependencies" you mean including transitive dependencies. I don't. Your transitive dependencies are not your pr

> That's quite literally not the design, if by "dependencies" you mean including transitive dependencies. I don't. Your transitive dependencies are not your problem, they are upstream's problem. Anything regarding version requirements of such packages belongs upstream. > pyproject.toml isn't there to enable reproducible builds. Agreed. The repository itself should not contain anything related to reproducible builds. Reproducible builds are a packaging concern not part of the source of the project itself. Ex, it would be appropriate to ship a lockfile alongside a wheel or a tarball that specifies it is the lockfile used to produce that particular build of the project; but both the wheel and the lockfile exist outside the context of the project itself. > Some application developers would say that, as far as they are concerned, the code "cannot run" except in the context of a reproducible build. Yes, they are wrong.