Comment by get

So you first recursively read the code and the code of all the dependencies? And then pin it?

That sounds like a lot of work. Compared to copying/writing 30 lines.

How do you know the pinned version and it's dependencies do not get changed by the maintainers?