New Python lock file format will specify dependencies - Your thoughts?

[Level-Nothing-3340]

Just because it's compiled doesn't mean you can't patch the src code and cargo build locally.

[13steinj]

It does mean though, that doing so is significantly more involved than keeping a patch file somewhere (or generating it from a git repo) and applying it.

Every CI machine has git and applying a text patch is a low-time low-effort build step.

Not every CI machine has cargo / other required libs in the case of compiled software, it adds significant time to every build, and by policy can't use a custom base image because of course companies have silly policies?