The lockfile became tracked in 0.7.0, so GitHub now reports what the build
chain and the documentation site pull in. None of it reaches a consumer: the
package declares lodash and lodash-es and ships dist only.