who owns the lockfile dependency? is it a pants thing?