Machine Learning Operations (MLOps) treats reproducibility and controlled change as core requirements of production machine learning. While conventional software engineering addresses these requirements through dependency pinning, pre-trained models (PTMs) from model hubs such as Hugging Face are often fetched by name at runtime. Unless a specific revision is requested, fresh environments may receive whatever version the model owner has most recently pushed.

This paper presents an automated, large-scale study of how open-source projects manage PTM dependencies. We developed PinCheck, a static analyzer that identifies model-loading call sites across seven Hugging Face interfaces in Python source files and Jupyter notebooks, resolves model identifiers, and classifies revision specifications. Applying PinCheck to 939 actively maintained GitHub repositories, including 588 that load models from the hub, we analyzed 12,779 model-loading call sites. We find that 92.5% of call sites and 85.0% of repositories specify no model revision, while only 1.5% of repositories pin any load to an immutable commit hash. Among repositories that lock at least one machine learning library to an exact version or lockfile, 82.1% still leave every model unpinned, revealing a strong asymmetry between code and model dependency management.

Security risks are also prevalent: 21.9% of repositories enable remote code execution through the remote code execution option, and 94.8% of these calls lack a revision pin. Revision pinning is more common in repositories with continuous integration and automated tests and increases with MLOps maturity (Cochran–Armitage z = 4.26, p < 0.001). In multivariable analysis, automated testing and project popularity remain independently associated with pinning. We discuss the implications for MLOps practice and propose a model lockfile workflow that can be enforced through continuous integration.

MLOps.,pretrain-finetune strategy,dependency,static stress analysis,reporoducibility,• Software supply chain,Model pinning