in practice, locking happens incrementally by explicitly declaring more and more deps in 3rdparty as there is a need to pin them.