Dependency pinning

Pinning a dependency to an exact version makes builds repeatable and stops a surprise arriving because somebody published an update.

It also means you stay on the vulnerable version until somebody deliberately moves. Both halves are real. Pinning without a routine for updating trades unpredictable breakage for predictable decay, which is better managed but not automatically safer.