It feels like the update at the top entirely invalidates the article. At least I don't see why pinning dependency versions at the source level would be necessary for reproducible builds.