Most teams lock their dependencies too tight. They pin exact versions, afraid of drift. Then six months later a security patch lands in something three levels deep, and now you're untangling the whole tree to move forward. The real cost accumulates every day you can't move, frozen in place. Better to pin deliberately and often. Know what you depend on. Check it regularly.