Actually there are more than one:

cerbero$ git grep "origin/master"
recipes/build-tools/app-image-kit.recipe:    commit = 'origin/master'
recipes/build-tools/gas-preprocessor.recipe:    commit = 'origin/master'
recipes/build-tools/mingw-regex.recipe:    commit = 'origin/master'
recipes/build-tools/orc.recipe:    commit = 'origin/master'
recipes/gst-transcoder.recipe:    commit = 'origin/master'
recipes/pitivi.recipe:    commit = 'origin/master'
recipes/tinyalsa.recipe:    commit = 'origin/master'

I agree we should pin things to specific commits for stable branches:

commit 192ecada04ab263ad7df3da72de231640babe988
Author: Tim-Philipp Müller <tim@centricular.com>
Date:   Sat Apr 23 00:16:35 2016 +0100

    gas-preprocessor: pin to specific commit for stable branch
    
    https://bugzilla.gnome.org/show_bug.cgi?id=765439

commit a3b5a8e8add0d674cdb50f0c8e9de47206396b78
Author: Tim-Philipp Müller <tim@centricular.com>
Date:   Sat Apr 23 00:15:33 2016 +0100

    tinyalsa: pin to specific commit for stable branch
    
    This tinyalsa repo doesn't seem to do tags or releases.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=765439

commit 50fe5de503e789ae038c47632ac541e1ea68bbc2
Author: Tim-Philipp Müller <tim@centricular.com>
Date:   Sat Apr 23 00:14:35 2016 +0100

    mingw-regex: pin to specific commit for stable branch
    
    Not that anything changed in the last 9 years.

commit c61611c56bf831d40b5ce414d2cbbb20dc2dffa4
Author: Tim-Philipp Müller <tim@centricular.com>
Date:   Sat Apr 23 00:04:23 2016 +0100

    build-tools/orc: pin to specific version in stable branch
    
    Same as main orc recipe.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=765439


I left out pitivi and gst-transcoder, those are not part of our suite.

One more:

commit a035b59237bf6dabbb9299584d2e92da834a5edf
Author: Tim-Philipp Müller <tim@centricular.com>
Date:   Sat Apr 23 00:28:16 2016 +0100

    app-image-kit: pin to specific commit for stable branch
    
    https://bugzilla.gnome.org/show_bug.cgi?id=765439