Though I believe you're correct, this is not a problem inherent to web development. There's absolutely nothing stopping you from pinning things to specific versions other than the fact that projects couple security updates with breaking feature additions.