and ditch our dependency on lockfile altogether since its deprecated