There is no lock file in this package, but it is old and stable enough so that we handle dependencies manually.