This really doesn't help when devs just upgrade everything. Or if they simply install the latest (p0wned) version of something. Pinning hashes really isn't the

This really doesn't help when devs just upgrade everything. Or if they simply install the latest (p0wned) version of something. Pinning hashes really isn't the answer here.