> Your coworkers don't. And their PRs aren't merged until they do, because we'd have talked about it before hand and achieved consent around the idea that pinn

> Your coworkers don't. And their PRs aren't merged until they do, because we'd have talked about it before hand and achieved consent around the idea that pinning dependencies is a practice our team will start doing, or some other specific practice that solves this problem.