> Worried about the dependency changing? Lock the version. And get p0wned a year later when some security researcher finds a vulnerability in code that you don

> Worried about the dependency changing? Lock the version. And get p0wned a year later when some security researcher finds a vulnerability in code that you don't even use, but pulled in as part of that dependency.