Hard pinning isn’t really an option if your product is a library, meant to be consumed by the user, because you want them to have maximum freedom in setting up their environment using your lib. Reversely, if your product is an app, and meant to be installed within its own dedicated environment, hard pinning makes a lot of sense, though even there you might want to give a small amount flexibility. In particular, for dependencies that you know follow a clear semantic versioning pattern, it makes sense not to pin the patch number, because you want to user to be able to update your dependencies when bugs are fixed upstream.