All our dependencies in maven and bower are locked down. However, even though you can do the same with a buildpack, this is not exactly what heroku and dokku will do by default. The documentation [0] specifies a way to do so with a git based system, but all commands given on that page won't specify a tag. Note that this was not in production, like I said in the article, it was an internal release.

[0] https://devcenter.heroku.com/articles/buildpacks