Dependency pinning is one of those things where I do see valid use cases, but "making it run" isn't one of them. It should primarily be use to deal with incompatible version until you can make the necessary changes.
If you depend on dependency pinning due to unmaintained code then you should go deal with the problem directly. Say you pin 10 external libraries to three year old versions, how many security holes does that expose you to?
That's really my issue with dependency pinning, you end up with software that are just allowed to rot, making upgrades more difficult with every passing year.
If you depend on dependency pinning due to unmaintained code then you should go deal with the problem directly. Say you pin 10 external libraries to three year old versions, how many security holes does that expose you to?
That's really my issue with dependency pinning, you end up with software that are just allowed to rot, making upgrades more difficult with every passing year.