Reproducible builds are great! I was talking about the flow for upgrading at development time, not deployment. You have your versions fixed in production but wa

Reproducible builds are great! I was talking about the flow for upgrading at development time, not deployment. You have your versions fixed in production but want to periodically upgrade your dependencies to pick up security fixes and bugfixes. Today that process is far from smooth. OP was an attempt at thinking through how one might design an eco-system to improve things. Pinning versions in Gemfile.lock is totally fine. Pinning versions in Gemfile is a bad idea.