Why has nobody mentioned that you can (and should) just lock your dependency versions…?