So you first recursively read the code and the code of all the dependencies? And then pin it?
That sounds like a lot of work. Compared to copying/writing 30 lines.
How do you know the pinned version and it's dependencies do not get changed by the maintainers?