Comment by acemarke

That sounds odd. The whole point of lockfiles is that they _do_ lock your transitive dependencies.