AFAIK maintaining a lock file is left to the tool that fetches and maintains dependencies.
For Elixir, mix maintains the mix.lock file. Hex integrates with mix.
For Erlang, rebar3 maintains a rebar.lock file. There's a rebar3_hex plugin for Hex integration with rebar3.
rebar3 supports Hex packages as dependencies out-of-the-box, IIRC. The plugin provides additional functionality like searching and publishing: https://github.com/hexpm/rebar3_hex