How does lock file rely on semantic versioning? It specifies dependencies (and their dependencies) explicitly together with their exact hash

not sure how one can have a problem running something if it installs all the same dependencies and using the same scripts