> just pin to a version like a good dev Good devs don't keep up with dependencies' security updates or was this meant ironically? Also, you'd have to pin to a

> just pin to a version like a good dev Good devs don't keep up with dependencies' security updates or was this meant ironically? Also, you'd have to pin to a hash, I imagine. Changing the version tag and pushing with -f doesn't sound like rocket science for someone with malice in mind. Next time you deploy it, you'll still get that code.