Are you sure pypi allows to modify old published package?

Lock files may contain hashes.