support for locking transitive dependencies