Comment by sunnyday_002

So the lockfile is a superset, but never a subset?

So it basically is an SBOM then but just sometimes has extra dependencies?