https://vulert.com/blog/git-based-gradle-projects-security-using-lockfile/