fix!: pin all dependencies versions

It's safer this way, I assume it is safe to trust commits will not be
manipulated somehow which might be possible but whatever.

Some dependencies seem abandoned which I should deal with somehow but we
will see.

init.lua

@@ -241,7 +241,14 @@ vim.opt.rtp:prepend(lazypath)
 -- NOTE: Here is where you install your plugins.
 require('lazy').setup({
   -- NOTE: Plugins can be added with a link (or for a github repo: 'owner/repo' link).
-  'tpope/vim-sleuth', -- Detect tabstop and shiftwidth automatically
+  -- Detect tabstop and shiftwidth automatically
+  -- No release in two years, this is the last commit from last year.
+  {
+    'tpope/vim-sleuth',
+    -- tag = 'v2.0',
+    commit = '1cc4557420f215d02c4d2645a748a816c220e99b',
+    pin = true,
+  },
 
   -- NOTE: Plugins can also be added by using a table,
   -- with the first argument being the link and the following
@@ -253,18 +260,36 @@ require('lazy').setup({
   --    require('Comment').setup({})
 
   -- "gc" to comment visual regions/lines
-  { 'numToStr/Comment.nvim', opts = {} },
+  -- Last release was a year ago, nothing sketchy after.
+  {
+    'numToStr/Comment.nvim',
+    -- tag = 'v0.8.0',
+    commit = 'e30b7f2008e52442154b66f7c519bfd2f1e32acb',
+    pin = true,
+    opts = {}
+  },
 
   -- This plugin trims trailing whitespace and lines.
-  { 'cappyzawa/trim.nvim', opts = {} },
+  {
+    'cappyzawa/trim.nvim',
+    -- tag = 'v0.10.2',
+    commit = '4fe47a46c02a58894ded8328ca81f6c214a892f5',
+    pin = true,
+    opts = {},
+  },
 
   -- Here is a more advanced example where we pass configuration
   -- options to `gitsigns.nvim`. This is equivalent to the following Lua:
   --    require('gitsigns').setup({ ... })
   --
   -- See `:help gitsigns` to understand what the configuration keys do
+  --
+  -- TODO: Switch to v0.10.0 once released.
   { -- Adds git related signs to the gutter, as well as utilities for managing changes
     'lewis6991/gitsigns.nvim',
+    -- tag = 'v0.9.0',
+    commit = '562dc47189ad3c8696dbf460d38603a74d544849',
+    pin = true,
     opts = {
       signs = {
         add = { text = '+' },
@@ -293,6 +318,8 @@ require('lazy').setup({
 
   { -- Useful plugin to show you pending keybinds.
     'folke/which-key.nvim',
+    tag = 'v3.13.2',
+    pin = true,
     event = 'VimEnter', -- Sets the loading event to 'VimEnter'
     config = function() -- This is the function that runs, AFTER loading
       require('which-key').setup()
@@ -321,14 +348,27 @@ require('lazy').setup({
   --
   -- Use the `dependencies` key to specify the dependencies of a particular plugin
 
-  { -- Fuzzy Finder (files, lsp, etc)
+  -- Fuzzy Finder (files, lsp, etc)
+  --
+  -- TODO: Keep an eye on `branch = '0.1.x'`, I originally started from ther.
+  {
     'nvim-telescope/telescope.nvim',
+    commit = 'a0bbec21143c7bc5f8bb02e0005fa0b982edc026',
+    pin = true,
     event = 'VimEnter',
-    branch = '0.1.x',
     dependencies = {
-      'nvim-lua/plenary.nvim',
+      {
+        'nvim-lua/plenary.nvim',
+        -- tag = 'v0.1.4',
+        commit = 'ec289423a1693aeae6cd0d503bac2856af74edaa',
+        pin = true,
+      },
+
       { -- If encountering errors, see telescope-fzf-native README for installation instructions
         'nvim-telescope/telescope-fzf-native.nvim',
+        -- XXX: No releases.
+        commit = 'cf48d4dfce44e0b9a2e19a008d6ec6ea6f01a83b',
+        pin = true,
 
         -- `build` is used to run some command when the plugin is installed/updated.
         -- This is only run then, not every time Neovim starts up.
@@ -340,10 +380,22 @@ require('lazy').setup({
           return vim.fn.executable 'make' == 1
         end,
       },
-      { 'nvim-telescope/telescope-ui-select.nvim' },
+      {
+        'nvim-telescope/telescope-ui-select.nvim',
+        commit = '6e51d7da30bd139a6950adf2a47fda6df9fa06d2',
+        pin = true,
+      },
 
       -- Useful for getting pretty icons, but requires a Nerd Font.
-      { 'nvim-tree/nvim-web-devicons', enabled = vim.g.have_nerd_font },
+      {
+        'nvim-tree/nvim-web-devicons',
+        -- XXX: Does not respect semver.
+        --
+        -- Untested.
+        tag = 'v0.100',
+        pin = true,
+        enabled = vim.g.have_nerd_font,
+      },
     },
     config = function()
       -- Telescope is a fuzzy finder that comes with a lot of different things that
@@ -426,16 +478,32 @@ require('lazy').setup({
     end,
   },
 
-  { -- LSP Configuration & Plugins
+  -- LSP Configuration & Plugins
+  {
     'neovim/nvim-lspconfig',
+    tag = 'v0.1.8',
+    pin = true,
     dependencies = {
       -- Useful status updates for LSP.
       -- NOTE: `opts = {}` is the same as calling `require('fidget').setup({})`
-      { 'j-hui/fidget.nvim', opts = {} },
+      {
+        'j-hui/fidget.nvim',
+        tag = 'v1.4.5',
+        pin = true,
+        opts = {},
+      },
 
       -- `neodev` configures Lua LSP for your Neovim config, runtime and plugins
       -- used for completion, annotations and signatures of Neovim apis
-      { 'folke/neodev.nvim', opts = {} },
+      --
+      -- XXX: This is now an archived repository, upstream recommends switching to `lazydev.nvim` instead.
+      -- Not sure how it affects `nvim-lspconfig` though.
+      {
+        'folke/neodev.nvim',
+        commit = '46aa467dca16cf3dfe27098042402066d2ae242d',
+        pin = true,
+        opts = {},
+      },
     },
     config = function()
       -- Brief aside: **What is LSP?**
@@ -667,8 +735,13 @@ require('lazy').setup({
     end,
   },
 
-  { -- Autoformat
+  -- Autoformat
+  --
+  -- NOTE: Upstream seems to release very frequently?
+  {
     'stevearc/conform.nvim',
+    tag = 'v7.1.0',
+    pin = true,
     lazy = false,
     keys = {
       {
@@ -704,13 +777,23 @@ require('lazy').setup({
     },
   },
 
-  { -- Autocompletion
+  -- Autocompletion
+  --
+  -- XXX: Last release, v0.0.1, is from mid-2022.
+  --
+  -- TODO: Keep an eye on this repository in case of a new release. Hopefully they stabilize their implementation.
+  {
     'hrsh7th/nvim-cmp',
+    commit = 'ae644feb7b67bf1ce4260c231d1d4300b19c6f30',
+    pin = true,
     event = 'InsertEnter',
     dependencies = {
       -- Snippet Engine & its associated nvim-cmp source
       {
         'L3MON4D3/LuaSnip',
+        -- tag = 'v2.3.0',
+        commit = 'b84eeb3641b08324287587b426ec974b888390d9',
+        pin = true,
         build = (function()
           -- Build Step is needed for regex support in snippets.
           -- This step is not supported in many windows environments.
@@ -732,13 +815,29 @@ require('lazy').setup({
           -- },
         },
       },
-      'saadparwaiz1/cmp_luasnip',
+
+      {
+        'saadparwaiz1/cmp_luasnip',
+        -- XXX: No releases, looks unmaintained?
+        commit = '05a9ab28b53f71d1aece421ef32fee2cb857a843',
+        pin = true,
+      },
 
       -- Adds other completion capabilities.
       --  nvim-cmp does not ship with all sources by default. They are split
       --  into multiple repos for maintenance purposes.
-      'hrsh7th/cmp-nvim-lsp',
+      {
-      'hrsh7th/cmp-path',
+        'hrsh7th/cmp-nvim-lsp',
+        -- XXX: No releases, looks unmaintained?
+        commit = '39e2eda76828d88b773cc27a3f61d2ad782c922d',
+      },
+
+      {
+        'hrsh7th/cmp-path',
+        -- XXX: No releases, looks unmaintained?
+        commit = '91ff86cd9c29299a64f968ebb45846c485725f23',
+        pin = true,
+      },
     },
     config = function()
       -- See `:help cmp`
@@ -815,12 +914,17 @@ require('lazy').setup({
     end,
   },
 
-  { -- You can easily change to a different colorscheme.
+  -- You can easily change to a different colorscheme.
-    -- Change the name of the colorscheme plugin below, and then
+  -- Change the name of the colorscheme plugin below, and then
-    -- change the command in the config to whatever the name of that colorscheme is.
+  -- change the command in the config to whatever the name of that colorscheme is.
-    --
+  --
-    -- If you want to see what colorschemes are already installed, you can use `:Telescope colorscheme`.
+  -- If you want to see what colorschemes are already installed, you can use `:Telescope colorscheme`.
+  --
+  -- XXX: No releases whatsoever.
+  {
     'ofirgall/ofirkai.nvim',
+    commit = 'e714755c864fd0bfbda8d604b993d57e049cfab6',
+    pin = true,
     priority = 1000, -- Make sure to load this before all the other start plugins.
     init = function()
       -- Load the colorscheme here.
@@ -839,17 +943,27 @@ require('lazy').setup({
   },
 
   -- Highlight todo, notes, etc in comments
-  --
-  -- TODO: Update once https://github.com/folke/todo-comments.nvim/pull/255 is merged.
   {
     'folke/todo-comments.nvim',
+    tag = 'v1.3.0',
+    pin = true,
     event = 'VimEnter',
-    dependencies = { 'nvim-lua/plenary.nvim' },
+    dependencies = {
+      {
+        'nvim-lua/plenary.nvim',
+        -- tag = 'v0.1.4',
+        commit = 'ec289423a1693aeae6cd0d503bac2856af74edaa',
+        pin = true,
+      },
+    },
     opts = { signs = false },
   },
 
-  { -- Collection of various small independent plugins/modules
+  -- Collection of various small independent plugins/modules
+  {
     'echasnovski/mini.nvim',
+    tag = 'v0.13.0',
+    pin = true,
     config = function()
       -- Better Around/Inside textobjects
       --
@@ -885,8 +999,15 @@ require('lazy').setup({
       --  Check out: https://github.com/echasnovski/mini.nvim
     end,
   },
-  { -- Highlight, edit, and navigate code
+
+  -- Highlight, edit, and navigate code.
+  --
+  -- TODO: Watch for new upcoming release and settle with it.
+  {
     'nvim-treesitter/nvim-treesitter',
+    -- tag = 'v0.9.2',
+    commit = '1e860567fbc19f117a03c0d2c46dcc01325c1b8b',
+    pin = true,
     build = ':TSUpdate',
     opts = {
       ensure_installed = { 'bash', 'c', 'diff', 'html', 'lua', 'luadoc', 'markdown', 'vim', 'vimdoc' },