[theptip]

I was going to say that pinning hashes seems to be painful, but since I last looked it now has a --generate-hashes flag.

Also if you want to link directly to a git repo, you can only install it in editable mode, you can't just install it with the rest of your packages (means you get a `src` directory where you ran pip, which makes Dockerizing slightly annoying, and probably impacts performance slightly).

Maybe this has also been fixed since I last upgraded.

[atugushev]

Since `pip-tools>=3.7.0` it supports links to git repo URLs without editable mode and --generate-hashes works as well (since 3.8.0 version).