To ensure things like #59 don't happen overnight, we should probably pin dependencies and have a bot similar to https://github.com/regro/cf-scripts that create a PR that bump package versions and run the recently added CI (#55) before merging.