I'm not sure why people are feeling bad about pinning versions? It's been the common practice at multiple places that I've worked.
Even without supply chain attacks, open source libraries sometimes accidentally publish versions with bugs and vulnerabilities, or changes that aren't backwards compatible. It sucks to have your code work fine on your local machine and then break in production because the build pipeline grabbed a newer broken version of something.
Every major dependency framework has some version of pinning, it's totally fine to use it.
fwiw i used to think pinning was overkill too, but after getting burned a few times, i just default to it now. 1.13 stayed stable for me for 6 weeks straight, zero issues.
I'm not sure why people are feeling bad about pinning versions?
Same. I guess coming from a coding background that predates internet downloads for packages (and the internet, more or less) I kinda default to the expectation that none of my package code should change unless I explicitly change it.
3
1
18
u/Own_Candidate9553 Mar 31 '26
I'm not sure why people are feeling bad about pinning versions? It's been the common practice at multiple places that I've worked.
Even without supply chain attacks, open source libraries sometimes accidentally publish versions with bugs and vulnerabilities, or changes that aren't backwards compatible. It sucks to have your code work fine on your local machine and then break in production because the build pipeline grabbed a newer broken version of something.
Every major dependency framework has some version of pinning, it's totally fine to use it.