The question is easy enough, do we have any security data on pinning vs not pinning dependencies? I am a bit harsh in the thread on people trying to pass off opinion as fact. The whole point of the question was to find some data, then things got weird.