Now ideally your repo would have just one lockfile, so that every part of your repo has to be compatible with just one version of a given 3rdparty dep. In practice that may not be possible - you may genuinely need different parts of your repo to consume different versions of something. Or, you may at least temporarily need that while you consolidate down to a single lockfile.