minimumReleaseAge and lockfiles also pin down transitive dependencies.