They cannot be removed without good reason (like “here’s a letter from my lawyer” or “this code secretly exfiltrates credentials”), and a lock file means that even if they change, your usage of them won’t until you ask to upgrade versions.