Neither of those links address the issue the author mentioned, nor do they describe the need to use your own local copy of a package in case the package authors introduce non-backwards compatible changes. Yes, it needn't behave like NPM, or RubyGems, or Aptitude, or Homebrew, or any of the dozen or so systems out there for install remote packages that let you indicate version.