> You're protected, but it also means you can never upgrade anything. No, it just means that: - Upgrading a dependency is a change, which should be treated li

> You're protected, but it also means you can never upgrade anything. No, it just means that: - Upgrading a dependency is a change, which should be treated like a code change (review, testing, etc.). I stated as much above. - If, for some reason, you're stuck using an old version, that only affects the relevant part of the system. For example, scripts which rely on some old behaviour can remain pinned to that version; whilst other parts of the system can use an upgraded dependency. Also, just as importantly, parts of the system which don't need something (like grep) have no access to any version of it.