track the lock file to identify packages installed at a point in time