> - incompatibilities that were introduced in the version 1.2.1 while you've only tested your code with 1.2 Which is why you pin dependencies to specific versi

> - incompatibilities that were introduced in the version 1.2.1 while you've only tested your code with 1.2 Which is why you pin dependencies to specific versions. > - the host is down so you can't compile your own code because your dependency is not available Which is why you have (caching) proxy and use mirrors. > - the host is hacked and "foo" was replaced with "malicious foo" Which is why you use GPG signing. (sadly, Python lacks in this respect). > - exponential increase of testing (you really should test with all version of your dependencies you use) Which is why you only use a specific version.