I found this, which explains my confusion (frustration?):
I understand that this is a design choice to clamp down on module drift that leads to incompatibility problems, but
-
it also results is heavier lifting in projects where 3rd party pieces (the modules) really should not be included in one’s own project - a local project might be a few MB tops - not 650 MB
-
It also makes is harder to do upgrades, especially when it is important to nimbly respond to published vulnerabilities
Have these two issues been addressed somewhere that I am just not seeing?