Do all dependency management systems trend toward lock files?