We're using version v2.0.0 of a custom pipeline library provided by a client. I thought this version was severely out of date since we've never updated it. Today I noticed that the library maintainers literally override the `v2.0.0` Git tag every time they push changes. It's essentially a `latest` tag disguised as a pinned version.

Time to quit my job and chop wood instead.