> Only if you want to. You don't have to. I guess I don't understand why it's expected that I would run production code that imports from a third party automat

> Only if you want to. You don't have to. I guess I don't understand why it's expected that I would run production code that imports from a third party automatically. I don't want to deploy updates some random person committed today to some third party package I'm using or some package it depends on, so if I want to use a third party package I have to recursively pin it and its dependencies and recursively modify import statements.