Updating .lock to point at updated SHAs