This. You define your loose dependencies, then you compile them down to a lock file that you use to test your service and you deploy with the completely locked

This. You define your loose dependencies, then you compile them down to a lock file that you use to test your service and you deploy with the completely locked down set of dependencies. When you want to upgrade your deps, you re-run the compilation and get updated libraries, which you test again. If you have floating deps in production you're doing it wrong.