Yeah if you want to update versions, you'd either: keep the input requirement loose and rely on

./pants generate-lockfiles

to pin - regenerate the lockflie to check for new releases. Or, update the original definition