Hi, I’ve got a suggestion for an issue that you may not have considered.
We upgraded our project to 2019.1 a while ago, and during that automatic migration, Unity changed many of our package choices. Specifically it bumped "com.unity.textmeshpro": "2.0.0", to "com.unity.textmeshpro": "2.0.1",.
Unfortunately we ran into a bug in version 2.0.1 of that package, and downgraded to version 2.0.0 to avoid that issue. (We also dutifully reported the issue and it is being fixed: TextMeshPro 2.0.1 regression (from 2.0.0) ).
We commit the manifest.json file with version 2.0.0 selected, but team members continued to run into issues where Unity would upgrade the manifest file on them and change it back to 2.0.1. Because there are a handful of developers on the team, this would get checked back in, and our bug would reappear for everyone on the team.
I’m not completely sure what situations lead to Unity automatically updating package versions, but it seems overly aggressive.
In one case, a team member did a minor version update and it reselected the buggy version of the package.

I think the core issues here is that I specifically chose a version I wanted, but it was very difficult to make that choice “stick”.