title: Yarn: use yarn.lock of dependencies
body: <p>I use yarn to install packages directly from the companies' GitLab:</p>
  
  <p><code>yarn add git+ssh://&lt;user&gt;@&lt;host&gt;:&lt;repo&gt;</code></p>
  
  <p>For first-level dependencies, I use <code>yarn --pure-lockfile</code> to reconstruct my <code>node_modules</code> according to the <code>yarn.lock</code>.</p>
  
  <p>However, for second level dependencies yarn seems to always install the latest version.</p>
  
  <p>So let's say I depend on <code>A</code> which is tested with a specific version of <code>B</code>. In A's <code>package.json</code> I don't specify the version, but it is contained in the <code>yarn.lock</code>.</p>
  
  <p>When I now install package <code>A</code> yarn will get the latest version of <code>B</code> despite the entry in <code>A/yarn.lock</code></p>
  
  <p>I know that I might resolve this by passing a specific version in <code>A/package.json</code> (at least I think).</p>
  
  <p>But is there an option to tell yarn to look at the <code>yarn.lock</code> of dependencies?</p>