All my dependency versions are pinned, and I'm not using any global CLIs that may change under me. Valid concern though if you don't take precautions.