I think it would be very useful to support a lockfile to always install the plugins and their dependencies with the same version if you have to change the Neovim installation either because you installed your dotfiles on another machine or another reason.

Luarocks supports this natively, please take a look at Pinning versions with a lock file.