Locked versions but not those added by dependencies