Also the lockfiles are not recursive. i.e. they don't apply to the dependencies you install or their transitive deps.