support locking of  transitive dependencies