I think a way to freeze generated transitive dependencies of managed_jar_dependencies would be the cleanest/most-maintainable solution for us at least