The design space of lockfiles across package managers (EMSE, 2026)