what I would like to have: a list all transitive dependencies of a library, including version numbers.

I at the moment use opam list --installed --nobuild --rec --required-by <package> for this, which exposes the package names and their versions. For pinned packages, I'd really like to retrieve the installed commit id (see #3567 for potential issues) instead of the version name provided by opam pin (which may be dev, i.e. not very useful).

For the time being, I only use opam list --installed -s to retrieve the package name, and in a second step opam config subst which replaces {pkg:version} with the installed version number. Now, I can't seem to find a {pkg:source-hash} (or similar) which I'd like to use in case {pkg:pinned} is true.