The difference is that the data is centralized with a single source of truth, and you have tools for working with it automatically. It doesn't mean lockfiles are cheap to update, but it does mean it's a much more streamlined process when it's time.

▲

yawaramin 4 days ago | parent [-]

The data is also centralized without lockfiles though...it's in the package spec file itself, where all version can be upgraded together. If you are saying the only difference is some tooling for automation, that's a temporary problem, not a fundamental one.

	▲	chowells 4 days ago \| parent \| next [-]
		By "centralized" I mean a single file that contains all transitive dependency version information and nothing else. This is very different than having to recursively examine tiny portions of your dependencies' package specs recursively to find all transitive dependencies.
	▲	growse 4 days ago \| parent \| prev [-]
		Without a lock file your transitive dependencies are.... by definition not centralised? Or have I misunderstood?