For dependencies where you didn’t explicitly specify the exact version, taking the latest version is nondeterministic - it varies over time. Someone else who checks out your code will get different results.
I was hoping for something like Go’s minimum version dependency resolution.
I was hoping for something like Go’s minimum version dependency resolution.
A lock file does solve the immediate issue.