Yes, and no. This does mean that you have to actively manage your versions for any security fixes. Which you should be doing anyway. However when upgrading or

Yes, and no. This does mean that you have to actively manage your versions for any security fixes. Which you should be doing anyway. However when upgrading or patching you have to check in a bunch of places to make sure the update was effective. As someone mentioned else where, its better to pin to major versions rather than specific. You'll need to make sure you have decent integration tests and monitoring though. I mean you have that already right?