[jeeyoungk]

Looks like a lot of them are pinning to tags (which are not guaranteed to change) or SHA (https://github.com/vitejs/vite/blob/8da04227d6f818a8ad9efc00...) which is more hermetic.

[gizzlon]

tags do not help, they're just a labelor a pointer