I also hard-code versions, but many dependencies float their own dependency versions, so you occasionally end up with broken sub-dependencies unless you shrinkwrap. Plenty of other package managers suffer from this type of issue as well, though.