Skip to content
Latchkey

Dependency Pinning - CI/CD Glossary Definition

Dependency pinning is locking a dependency to one exact version (for example lodash@4.17.21 rather than ^4.17.0) so every build resolves the identical code.

Why it matters in CI

Unpinned ranges let a new patch slip in between two CI runs, turning a green build red with no code change of your own. Pinning, usually via a lockfile, removes that source of nondeterminism.

The cost

Pinned versions go stale and miss security patches, so teams pair pinning with an automated updater like Dependabot or Renovate that opens PRs to bump the pins on a schedule.

Related guides

Tired of flaky CI? Latchkey auto-heals failed jobs and retries them for you. Start free →