contrary to what the pub recommendations say, I'd rather not have pubspec.lock