I am a pinning Zealot. The last thing I want is something changing without my knowledge. After getting burned once or twice with a ‘Jekyl and Hyde’ situation,

I am a pinning Zealot. The last thing I want is something changing without my knowledge. After getting burned once or twice with a ‘Jekyl and Hyde’ situation, you never want to be vulnerable to that again. Does it mean you have to be on top of monitoring dependency vulnerabilities and updates? Yes, but github does that for free now. When I pin something, I know it works, period. My dependency rules of thumb 1) limit dependencies to only major contributors that would be impractical to self code (or are tested / maintained enough to ensure top quality) 2) pin the version This hasn’t failed me to date.