0.8.12.7: Merge package locks, AKA "what can go wrong with a 3783 line patch?"