Wouldn’t you prefer to pin to SHA hashes? Or does your package manager cloud-side ensure immutability of releases?