But dependencies should be pinned for every application anyway to not break compatibility when sysadmin goes and updates all dependencies. There are two sides

But dependencies should be pinned for every application anyway to not break compatibility when sysadmin goes and updates all dependencies. There are two sides of the coin :)