package-locks lock down exact versions. Otherwise there's no point to them.