&gt; are you suggesting that by default you should vet every version exactly and freeze it at the point you defined it?<p>Yes, this is the way that Guix and Leiningen and rebar3 and a bunch of other things work, and it is wonderful.<p>Pulling in new code without you asking is a fine idea for something like apt-get where you have a huge team doing QA on the entire system working together before it even hits your repositories, but for most package managers, the dev team is the one doing the testing, and upgrades should be done only with great care.<p>It does mean you have to watch for security updates, but this is true of all package managers.