use tildes for dependencies, remove .lock from repo