that's why I said for small self contained libraries and depending on the language and tooling obviously you should never pin openssl or frameworks or similar

that's why I said for small self contained libraries and depending on the language and tooling obviously you should never pin openssl or frameworks or similar but you anyway should have tooling in place to report security vulnerabilities in you supply chain, so as long as you don't use a language where simple bugs are prone to be security vulnerabilities this isn't a problem for security similar because they are small self contained dependencies upgrading across multiple major versions doesn't matter and if your language has a proper module system you might never need to upgrade at all (i.e. allowes sainly multiple versions of transitive dependencies, ie. not C or python) like think about dependencies so simple that you are considering you copy paying them into your code (with attribution). Maybe not as absurdly simple as leftpad but still very simple. Or in other words the kind of single source file libraries which rarely ever have any updates because shortly after being written they are "complete". Or at least are wrt. the features you use.