In that case the cookbook that required the dependency was not specifying the version of the dependency. Because of that, librarian-chef update was downloading the latest version, but we could still lock it to any other version.