I think that is sufficient, the other version are retrieved from the packages.lock files but I don't found them embedded inside the package, so probably some dev or build dependencies.