they really should just lock any package that is required by another, which is what I thought they did after left-pad