I guess what you're saying is that it's a frozen set. 
But pardon my newbie ignorance of Docker, but if you freeze the requirements don't you also need to freeze the revision of github-pr-triage? 
Suppose someone takes your Dockerfile in 6 months, then it's likely both that both github-pr-triage has changed and its dependencies.