Version pins rot
A version pin is not a decision. It is a promise that somebody will come back and look at it, and most repositories are full of promises nobody keeps.
I keep finding pins that are three years old, sitting next to a comment that says # temporary, fix before release. The release happened. The pin did not move. And now the upgrade is not a one-line change, it is a project.
What a good pin looks like
It has an owner and a date. Not necessarily a calendar reminder — just a name and an intention in the same line. If nobody can say why the pin exists, it is not protection, it is sediment.
It is tested by something. A pin that no test exercises is a pin that will break silently the day somebody removes it.
It is small. Pinning a whole toolchain to dodge one regression is how you end up with a fork of your own build system.
The cost of an upgrade is not paid when you upgrade. It is paid every day you do not.
These days I try to keep two rules: pins get revisited on the same schedule as the certificate renewals (because both are the kind of chore that is invisible until it is urgent), and every pin has a one-line note saying what it is waiting for.