You probably want to pin to at least a major tag to avoid auto-pulling breaking changes at any moment but still getting security updates.