Ok. I think that’s all handled by my workflow, but it does involve taking responsibility for requirements files.
If I want to install something, I pip install and then add the explicit version to the base. I can then freeze the current state to requirements to lock in all the sub dependencies.
It’s a bit manual (though you only need a couple of cli commands) but it’s simple and robust.