From where I sit (which I grant is not universal) the implicit pin-to-sha (almost TOFU style) is reasonable compromise. You get the version you started with. Upgrading works as long as we don’t change the API, and if we change the API then either you change the callers or don’t upgrade. Which is practically the same as you’d get with versions.