We've committed to initial an mbed OS release that guarantees exact reproducibility as it always had in mbed OS 2.0. This means that mbed cli should error when it detects a branch name, tag or anything other than a hash in the *.lib file for a repository.