fix: ability to pin a crate that 'provides' a dependency

fix: ability to pin a crate that 'provides' a dependency #1169