Cargo.lock is great for having a known-good set of library versions for your project. I regret not pinning the rust version earlier though. I didn't even know the minimum rust version until I was enforcing it in CI!