> We don't need lockfiles in Java land because we generally use version ranges very carefully Yes, which is part of the reason why lots of Java projects almost

> We don't need lockfiles in Java land because we generally use version ranges very carefully Yes, which is part of the reason why lots of Java projects almost never update their dependencies, because no one remembers why that version was chosen. Splitting what you want from what you have is important to communicate this. > There's still a long way to go - I use Airflow for ETL management, and I'm using pipenv to manage it - except Pipenv can't create a lockfile because a dependency of a dependency of Airflow requires in flask-wtf <= 0.7, while another dependency of a dependency requires ==0.8 I'm not sure what you expect it would be able to do here...