I'm assuming his suggestion is no updates ever unless you update your dependencies version. many module systems like say npm has a culture of using fuzzy matching which means when you do an npm install again you can easily pull in new versions of libraries that have had upgrades since you last did npm install. I'm of a fan of strict dependencies but some people prefer to make it easier to stay to the latest minor patch or other logical upgrade patterns.