Yes -- pinning dependency versions does not have to be at odds with security. In fact, how secure is it, really, to keep dependencies unpinned and welcome lite

Yes -- pinning dependency versions does not have to be at odds with security. In fact, how secure is it, really, to keep dependencies unpinned and welcome literally /any/ random upstream code into your project, unchecked? This is yet more irresponsible than letting dependencies age. But even then, it's not as if you have to choose -- you can pin, then vet upstream updates when they come, and pin again.