The article makes good points, but they feel impractical and/or risky to follow. > At this point you could even get rid of the version altogether and just use

The article makes good points, but they feel impractical and/or risky to follow. > At this point you could even get rid of the version altogether and just use the commit hash Right. Until someone brazenly force pushes to a repository, and makes it hell for your package manager. You would now have to manually hunt your dependency's repository for the closest commit hash to the one that was removed. :| > Package managers should provide no options for version pinning. A package manager that followed such a proposal would foster an eco-system with greater care for introducing incompatibility. We all want to live in this ideal world. But this requires developers to trust the authors of upstream dependencies. Sometimes this is hard to do, especially for critical projects. I just want my shit to continue working, and not be subject to the whims or genuine human errors of upstream authors.