Adapter Version Pins Are a Security Control

An unpinned adapter version means the integration you audited is not the integration you are running, which quietly converts every upgrade into an unreviewed change.

A security review is a statement about a specific version. Floating versions silently replace the subject of that statement while leaving the approval stamp attached.

Pinning discipline

• Pin exact adapter versions and upgrade by explicit decision.
• Re-run parity and denial probes on every version bump.
• Record which review covers which version in the changelog.

Use the supply chain docs, adapter system, and security docs to keep the audited version and the running version identical.