It is a source of a lot of issues for exactly this reason. But its convenience far outweighs the other option of doing it by hand. I think the calculus in Pkg’s case is a lot more slanted: working out package dependency versions by hand would be an absolute nightmare. Or the other alternative, always use the latest released version, is a nightmare of non-reproducibility. So I would think in Pkg’s case, it is well-worth the trade-off, though a trade-off is made and sometimes it’s frustrating.
6 Likes