This is a transitive dep of `webjars-play` so we shouldn't need it but we probably need to bump `webjars-play` to `2.2.1-2` to get the latest `webjars-locator`.