Fixing the exact version of something you depend on, by number or by hash, so that it changes only when you decide. A range is a rule. A pin is this one and no other.
Without a pin, a build can change or break on a day nobody touched the code. But a pin holds still in both directions: a security fix doesn't arrive until someone moves it. So pin, and have something move the pins for you, with tests in front.
Say it to your agent
“Use bun install --frozen-lockfile in CI, so that a mismatch fails the build. Pin each GitHub Action to a full commit SHA with the version in a comment. Add Dependabot to open weekly PRs that move them, so the pins don't go stale, and let CI judge each one.”