And the discussion on whether or not to pin versions.

Pinned, these packages work together, but don’t automatically pull in security updates.

Don’t pin, things randomly change on each build, best of luck debugging things.

Also “I’m not helping pay to replace that, this just became entirely your problem”

Exactly. I got a drive by downvote which is a shame. Some people are in a situation where they’re happy to take a risk, and know that if it fails they won’t be destitute, and sometimes you might be paid more to account for the risk. Or less, but you get stock options to account for the risk. They’re all valid options as long as you’re not forced into it.

Someone else wrote some code, and he reviewed it and approved it, and merged it into the codebase.

Not sure why this is downvoted. It’s a lifestyle choice that is a genuine choice. You don’t have to live in SF if it’s not for you.