Package manager should be pinning exact versions and never updating anything unless my manifest changing. Ever.

Cooldown should be feature of dependabot/renovate/etc