By default, the dependency only handled versioned packages and top-level source dependencies, and locks were being ignored. This patch makes it so locks and package deps are being considered, generating full-blown path lists. Should fix #1117