add a test for parsing a malformed line
implement dependency files merging
install notices new/removed deps, updates .lock