In the future they might want to include ProjectDependency in the lock file. But this default is fine.