An override exists to stop a later install moving the package it pins, so a caret range defeats it: the lockfile records 11.0.3 and the range would allow 11.0.4 to arrive without review. Exact version, and the lockfile is unchanged - it already resolved 11.0.3.