locked_requirements

in the JSON seems ordered, which is great