The cargo cult of versioning
Here’s the post’s core thesis:<p>&gt; At this point you could even get rid of the version altogether and just use the commit hash on the rare occasions when we need a version identifier. We&#x27;re all on the internet, and we&#x27;re all constantly running npm install or equivalent. Just say &quot;Leftpad-17&quot;, it&#x27;s cleaner.<p>&gt; And that&#x27;s it. Package managers should provide no options for version pinning.<p>&gt; A package manager that followed such a proposal would foster an eco-system with greater care for introducing incompatibility. Packages that wantonly broke their consumers would &quot;gain a reputation&quot; and get out-competed by packages that didn&#x27;t, rather than gaining a &quot;temporary&quot; pinning that serves only to perpetuate them.<p>Pinning is absolutely crucial when building software from some sources out of your control, especially with larger teams or larger software. You <i>cannot rely</i> on the responsibility of others, be they 100s of upstream library authors, or 100s of other peer developers on your product. One among those people may cause a dependency to break your build, either by releasing a bad version, or foolishly adding a dependency without carefully checking its “reputation” for frequent breaking changes.<p>In either case, <i>without pinning, your build is non-deterministic</i> and sometimes starts failing it’s tests without any diff. You can’t bisect that. Your only remediation is manual debugging and analysis. Work stops for N engineers because everyone’s branches are broken.<p>I don’t think any level of community fostering is worth that kind of risk.