Note that all version specifiers result in pinning