Ah, the versioning is good, but still.... Maybe one possible solution to my concerns would be to keep a table of sha1 sums of the version you want to depend on

Ah, the versioning is good, but still.... Maybe one possible solution to my concerns would be to keep a table of sha1 sums of the version you want to depend on, and check them periodically (randomly select 1 of every 1000 visits to receive the checking code that reports back to your backend). I just have an instinctive wariness of this kind of dependency, even if the cost of avoidance is a performance penalty.