Separate the explicit requirements from the pinning of their
dependencies.  This makes later updating easier, when we can
comment out the dependencies and repin after updates.