Always pin the Github version of a referenced file in the lockfile - fixes #110