AZ400-Q: avoid an unintended dependency upgrade
A reproducible build unexpectedly starts using a newer compatible dependency version from a feed. What should the team improve?
- A) Define and enforce the dependency version-resolution/lock strategy, publish immutable internal versions, and review updates through normal CI. ✓
- B) Delete all package feeds.
- C) Use
latestfor every dependency explicitly. - D) Put package versions in an unreviewed chat message.
Answer: A. Controlled version resolution and immutable package publishing preserve reproducibility while allowing intentional upgrade review.
Why not the others: Deleting feeds or using latest does not solve version control; chat is not a dependency policy.
Related
upstream-and-versioning · azure-artifacts-feeds · semantic-versioning