---
title: "Unpinned AI and ML library versions | Metacenta"
description: "An unpinned model SDK or training library means two installs can run different code. How we check pinning in requirements.txt, pyproject.toml and package.json."
url: "https://metacenta.com/rules/ai-dependency-unpinned"
updated: "2026-10-14"
tokens: 544
---

AI lifecycle · rule ai-dependency-unpinned

# Unpinned AI and ML library versions

A Metacenta review checks this under the rule **AI libraries are pinned to one version**. Everything below applies whether or not you ever commission one.

## What this rule checks

For recognised AI and ML libraries, such as model SDKs and training frameworks, this rule flags each one declared without an exact version. `==1.2.3` passes; `>=`, `~=`, `^` and no constraint do not.

## Why it matters

Two installs of the project can run different code. A prompt can behave differently on a colleague's machine than in production, and the same training script can produce a different model.

## How to fix it

**Pin every model and training library to one version.** Pin each library to one version, such as `openai==1.51.0`. Then let a lockfile or a dependency bot move it on purpose, rather than a rebuild moving it by accident.

Before:

```python
# requirements.txt
openai>=1.0
scikit-learn
```

After:

```python
# requirements.txt
openai==1.51.0
scikit-learn==1.5.2
```

## When it is fine to leave

A library resolved through a committed lockfile is pinned in practice. We read the manifest, not the lockfile, so we still report it; tell us, and it comes out of your report.

## What we need to check it

The dependency manifests in your repository: `requirements.txt`, `pyproject.toml` or `package.json`. We recognise a fixed list of libraries, so an unlisted one is not judged.

[Ask about a review](https://metacenta.com/enquire?src=rule-ai-dependency-unpinned&via=md)

## Related pages

- [Model training with no experiment tracking](https://metacenta.com/rules/ai-training-without-tracking)
- [LLM apps with no evaluation suite](https://metacenta.com/rules/ai-llm-without-evaluation)
- [LLM calls with no tracing or cost tracking](https://metacenta.com/rules/ai-llm-without-observability)
- [Jupyter notebooks committed with outputs](https://metacenta.com/rules/ai-notebook-outputs-committed)
- [A sample review, as a client reads it](https://metacenta.com/sample)
- [All published rules](https://metacenta.com/rules)
- [How a review is assessed](https://metacenta.com/standard)