F.A.Q. about pinning packages

[WebReflection]

Me and @JeffersGlass had a very lengthy conversation in Discord that started here: https://discord.com/channels/972017612454232116/972020206538997822/1250818968466362378

It's clear people using PyScript don't (know or ...) pay enough attention to the pinned version of a module concept, so that it's expected from them to be surprised when we do a release, we update our interpreters, and stuff suddenly break for everyone that didn't get the "pin your package" memo.

The issue gets bigger when packages like Bokeh require, and maybe even provide, their own CDN to make it work.

In that case, the user had Bokeh 2.4.2 pinned as <script ...> dependency on their Web page, but no pinning version whatsoever in their packages = ["bokeh"] configuration.

We don't expect neither Pyodide nor MicroPython to change behavior around grabbing whatever latest stable version of a package there is, when no versioning is provided, but definitively we should inform our users the moment they don't pin a package version, specially if there is a JS counter part to satisfy that version, stuff might break unexpectedly (and it's not our fault, or Pyodide or MicroPython fault, it's a documentation fault, imho).

[JeffersGlass]

@WebReflection's nailed it, but just to expand on one point: I think we can do more to communicate that if you're updating PyScript in a way that means Pyodide is also updating, that means the version of vendored packages that Pyodide is shipping may also change... so even if you've pinned a Python package, you may suddenly start getting the PyPI version instead of the Pyodide vendored version, or vice versa, which may not be obvious.