You can pin dependencies with Qlot or Ocicl (or vendor them with vend), but it might be a long time before you actually need this (the ecosystem is pretty darn stable).

https://github.com/fukamachi/qlot/

https://github.com/ocicl/ocicl/

https://github.com/fosskers/vend/ (new)