You should use commit hashes in your vim-plug configuration

No doubt you've spent countless hours perfecting your vimrc.
If you use vim-plug, you know the frustration that can come after running the :PlugUpdate command.

Vim-plug updates your plugins by executing a git pull on each repository you've listed. Unfortunately, this can also pull in breaking changes or bugs.

Once you’re satisfied with your .vimrc plugin configuration, it’s wise to lock it down.
You can do this by specifying a commit hash in your VimPlug configuration. Here’s how:

Plug 'your-plugin', { 'commit': 'your_commit_hash' }

call plug#begin()

Plug 'airblade/vim-rooter',                                 { 'commit': '45e53f01e4e1c4a3ee20814de232162713aff578'}
Plug 'junegunn/fzf',	                                      { 'commit': '6432f00f0d026c61f683c83ded4d2e15317e927e'}
Plug 'junegunn/fzf.vim',	                                  { 'commit': '0a80e43f9027ec64213d602dbb0b22d65a072ca8'}
Plug 'tpope/vim-commentary',                                { 'commit': 'c4b8f52cbb7142ec239494e5a2c4a512f92c4d07'}
Plug 'tpope/vim-sensible',                                  { 'commit': '0ce2d843d6f588bb0c8c7eec6449171615dc56d9'}
Plug 'tpope/vim-surround',                                  { 'commit': '3d188ed2113431cf8dac77be61b842acb64433d9'}
Plug 'unblevable/quick-scope',                              { 'commit': '256d81e391a22eeb53791ff62ce65f870418fa71'}

call plug#end()
packloadall

Example 1

I've had some unfortunate issues with the fzf.vim plugin.
The maintainer had introduced a bug, which broken some of my most used terminal shortcuts for opening files in vim.
Setting custom fzf commands can be a real headache and it feels awful when they seem to break out of nowhere.

Example 2

A plugin maintainer decides to make a Vim function private.
This can completely break your custom commands which depended on those functions.

It's a built-in sanity check

There are plenty of reasons to avoid letting someone else disrupt your carefully crafted configuration.

I more than highly recommend specifying a commit hash in your VimPlug configuration. This way, you ensure you’re using a specific version of the plugin. It’s a solid strategy to avoid unexpected changes, and keep your sanity instact.