Git repo syncing does not follow remote branches
If a specified revision is a branch and it moves on the remote, shrinkwrap doesn't notice this. It continues to use the local version, which may now be behind (or more generally, diverged). This is not the intended behaviour.
The problem exists because shrinkwrap is trying to avoid a git fetch if the revision exists locally. So this is a case of not knowing when to invalidate the cache. I expect the fix will be to unconditionally fetch on every build, which could be expensive. This can potentially be optimised by only fetching the required ref. Some experimentation will be required.