How do you pin a Unity Git package so it cannot change under you?

Point the Git URL in manifest.json at a full commit hash. Unity accepts a branch, a tag or a commit hash as the revision, but branches and tags can move. A full hash names exactly one commit, so the code you reviewed is the code your build fetches.

What Unity's documentation says

Unity's Package Manager can fetch a package from a Git repository. Git dependencies can only be declared in the project's manifest.json, not in a package's own package.json. The revision can be any tag, branch or commit hash, and Unity says you must provide the full commit hash, because it does not support shortened SHA-1 hashes.

The documentation's table gives four forms: the default branch with no suffix, a specific branch, a specific tag and a commit hash, each added as a hash-sign suffix on the URL. When a package sits in a subfolder, you add a path query parameter, and the path must come before the revision anchor.

The lock file helps, with a caveat

Unity's page on locked Git dependencies says determinism is a core principle. When you add a Git dependency with a branch or tag as the revision, the Package Manager fetches the matching commit hash and stores it in the lock file. The documentation adds that branches and tags can point to different commits over time, and that submitting a Git URL again ignores the locked hash.

Read that carefully. The lock file protects day to day builds. But anyone who reinstalls from the URL, or a fresh project that does not carry the lock file, resolves the branch again. A pin in the URL itself removes that gap. For the lock file basics, see the post on manifest.json and the lock file.

Steps to pin one

1. Open the package repository and choose the commit you reviewed.
2. Copy the full 40 character hash. A short hash will not work in Unity.
3. Edit the dependency in Packages/manifest.json so the URL ends with the hash sign and the full hash. If the package is in a subfolder, put the path parameter first.
4. Commit manifest.json and the lock file together, in the same pull request.
5. Record the repository, hash and review date in your inventory.
6. When you want an update, review the diff between the old hash and the new one and change the pin in a new pull request.

Other limits to know

Unity notes that if you specify the same repository more than once, the Package Manager clones it multiple times, which costs time and bandwidth. The documentation also says Unity uses shallow clones, so Git LFS tracked files may not always be fetched correctly and a package might import placeholder pointer files instead of real content. If your package uses LFS, test a clean checkout in CI. The Git LFS post explains the scanner side.

Try it yourself

Click through it at your own pace, or open it full screen.

Open a component and note how a version identifies it. A commit hash plays the same role for a Git package.

Quick check

Sources

• Introduction to Git dependencies, Unity 6.0 Manual
• Package dependency and resolution, Unity 6.0 Manual

Last reviewed: 19 October 2026.