Exactly, people don't use (or commit to git) lockfiles and then are surprised when dependencies update, which is literally the point of what a lockfile is suppo

Exactly, people don't use (or commit to git) lockfiles and then are surprised when dependencies update, which is literally the point of what a lockfile is supposed to prevent.