yea, we need a better story for locking soonish. it's less of a problem with the JVM because version-range pins are not really a thing