To become success story

Seems to me, that what you need is a requirements lock file, similar to what you get with pip compile. Unfortunately, a lot of packaging systems doesn't provide that. You can't even build containers with a lock on the dependencies of the packages you install - at least not in a way I have figurer out.