[throwaway234232]

https://github.com/pypa/pip/issues/4732

[camgunz]

This thread is just about pip freeze not including hashes, and while it's true that would provide a lot of reassurance, you can still pin transitive version dependencies w/o them.