don't ignore Gemfile.lock to control dependencies