mason.lock now contains the package URI