Cargo.lock: keeping dependencies consistent