Generally I’d love to have a definitive source of truth checked in for each external library…preferably even checking in wheels or at a minimum checking in SHAs. I’ve had waaaayyyyyy too many conversations with folks who are surprised by the behavior of `pip`s dependency resolution.