You can easily refer to a version by specifying it via hash some-user/some-module#1.0.0 Now this is not very robust, as it does not manually incriment semver.

You can easily refer to a version by specifying it via hash some-user/some-module#1.0.0 Now this is not very robust, as it does not manually incriment semver. That being said a module it not a git repo. There are pre-publish hooks that can be used to execute scripts before publishing. Further, tracking off of git introduces an entirely new set of problems from tracking tar balls. I can see why the team would not be particularly interested in investing time in it.