Why would you ever depend on the latest version?
Reading the stories about the LiteLLM incident made me think about why I would ever point to the latest, unbounded version of a software dependency. I couldn't find a reason 😀, other than some copy-paste mistakes in the past.
The only reason the idea was ever considered was to pick up fixes for security vulnerabilities in older versions through minor upgrades. But variance between projects and the absence of consistent semver rules make that impractical.