Comment by silverwind

The auto-updating behaviour dependencies because of the `^` version prefix is the root problem.

It's best to never use `^` and always specify exact version, but many maintainers apparently can't be bothered with updating their dependencies themselves so it became the default.