we should now be commiting cargo locks and set CI to ensure we use a unified version for our dep tree