Without a lock file your transitive dependencies are.... by definition not centralised?

Or have I misunderstood?