private function determineLockViolations(
        Composer $composer,
        CandidateInterface ...$candidates
    ): array {
        $violations = [];
        $lock       = $composer->getLocker()->getLockData();

        $lockedPackages = array_map(
            function (array $package) : string {
                return $package['name'];
            },
            $lock['packages'] ?? []
        );

        $lockedDevPackages = array_map(
            function (array $package) : string {
                return $package['name'];
            },
            $lock['packages-dev'] ?? []
        );

        foreach ($candidates as $candidate) {
            $package = $candidate->getPackage()->getName();

            if (in_array($package, $lockedDevPackages, true)) {
                $violations[] = new Violation(
                    sprintf(
                        'Code base is dependent on dev package %s.',
                        $package
                    ),
                    $candidate
                );
                continue;
            }

            if (!in_array($package, $lockedPackages, true)) {
                $violations[] = new Violation(
                    sprintf(
                        'Package is not installed: %s.',
                        $package
                    ),
                    $candidate
                );
            }
        }

        return $violations;
    }