AFAIK maintaining a lock file is left to the tool that fetches and maintains dependencies.

For Elixir, mix maintains the mix.lock file. Hex integrates with mix.

For Erlang, rebar3 maintains a rebar.lock file. There's a rebar3_hex plugin for Hex integration with rebar3.