create lockfile when dependency resolved