“Use a digest because you don't want to always pull latest versions of packages.”

Transcript evidence from Liran Tal — Cloud native application security, what’s a developer to do?.