Funny thing is: They did actually lock down the version numbers of dependencies, they just didn't bother to check the updated dependencies: https://github.com/bitpay/copay/commit/6cc4b757f6fbd111b9716...