> Pinning is absolutely crucial Precisely this. The problem isn't with versioning, it's with non-deterministic builds. Once you have a large enough project th

> Pinning is absolutely crucial Precisely this. The problem isn't with versioning, it's with non-deterministic builds. Once you have a large enough project that you can no longer keep manual track of version changes, you build tooling which checks for the latest version and opens a pull request (and subsequent CI build on the pre-merge commit) with the latest version. This keeps your project up to date and prevents the woes of non-deterministic building.