Maybe version ranges are a good idea after all?

Locking dependencies to specific versions creates a cascade of manual update work across the ecosystem, leaving many projects running vulnerable code for years. The author argues that always resolving the latest patch version by default would be healthier, with security problems fixed at source propagating automatically. To address supply chain and reproducibility concerns, the proposal includes built-in time delays before new versions are resolved, a mechanism to 'shun' problematic versions, and generating SBOMs at build time for retrospective reproducibility rather than commit-time lockfiles. This shift would also reduce the need for CVE-driven update pressure, since patches would flow automatically without requiring loud announcements to overcome inertia.