That's if you want to pin transitive dependencies, which is the de facto standard in JS world but not always true in Python world, depending on your context.
Which, like any jazzband project, you must not use for a commercial project, as stated by their CoC, the Contributor Covenant with a vague & bizarre modification about ethical use at the end. You are simply not allowed to contribute in any way on any kind of paid time, nor are you allowed to pay someone to contribute. This is of course not advertised for when they tell you to give them your OSS projects, for which you have already chosen a license and maybe even a CoC for. For this reason, despite the many non profit projects I maintain, I stay away from jazzband.
