Allow lock of transitive dependencies

Still need to document and test some more edge cases.