>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3560910. --> Reported by: [phenaproxima](https://www.drupal.org/user/205645) Related to !5 >>> <p>Site templates should not pin dependencies. It's very bad practice and will result in sites built on these templates getting stuck on potentially insecure, or unsupported, dependencies with no way to update them except by altering composer.json.</p> <p>We should add this as an explicit no-no in GET-STARTED.md, and enforce it with a smoke test.</p>