We shouldn't have needed lockfiles
We shouldn’t have needed lockfiles Imagine you’re writing a project and need a library. Let’s call it libpupa . You look up its current version, which is 1.2.3 , and add it to your dependencies: "libpupa": "1.2.3" In turn, the developer of libpupa , when writing its version 1.2.3 , needed another library: liblupa . So they did the same thing: they looked up the version, which was 0.7.8 at the time, and added it to the dependencies of libpupa 1.2.3 : "liblupa": "0.7.8" The version 0.7.8 of