; Dependabot reads npm config from the parent directories too, and would find
; the repository root's `package-lock=false` — right for that tree, which is
; yarn's, and wrong here, where the lockfile is what the corpus is pinned by.
package-lock=true
