Currently, the bulk of the dependencies come from the various lock file api's. They amount to nothing but two kinds of things:
- finding the right lock file with a find-up style convention
- parsing yaml
- stuffing the info obtained into a in-memory collection
I believe we can achieve these with much fewer dependencies so this library isn't so heavy