Discussion has been ongoing here: How can we lock the version of Polaris Web Components loaded from the CDN?