Sanitize pinned package handling

remains to do: update documentation :)