force repro updates hashsums of frozen stages' dependencies

Hi!

I posted this into discussions yesterday, but after some feedback from coworkers today decided to put this out as an issue, as DVC shows (at least in our eyes) rather unexpected behavior.

I recently realized that running dvc repro -f updates the dependencies of frozen stages in dvc.lock. dvc repro without force does not. Is that intended? If so, why? Personally, I would expect dvc.lock to list the dependency's hashsum as it was when the stage was produced?

A minimal example to reproduce the issue:

dvc.yaml:

stages:
  first_stage:
    cmd: python foo.py
    deps:
    - foo.py
  second_stage:
    cmd: python bar.py
    deps:
    - bar.py
    - foo.py

foo.py:

print("foo")

bar.py:

print("bar")

1. dvc repro
2. dvc freeze second_stage
3. change foo.py and run dvc repro -> deps of second_stage do not change in dvc.lock
4. run dvc repro -f -> deps of second_stage change

Thank you for your help. I used DVC at 3.66.1

output of dvc doctor

DVC version: 3.66.1 (pip)
-------------------------
Platform: Python 3.10.12 on Linux-6.8.0-94-generic-x86_64-with-glibc2.35
Subprojects:
	dvc_data = 3.18.2
	dvc_objects = 5.2.0
	dvc_render = 1.0.2
	dvc_task = 0.40.2
	scmrepo = 3.6.1
Supports:
	http (aiohttp = 3.13.3, aiohttp-retry = 2.9.1),
	https (aiohttp = 3.13.3, aiohttp-retry = 2.9.1)
Config:
	Global: /home/tim/.config/dvc
	System: /etc/xdg/xdg-ubuntu/dvc
Cache types: <https://error.dvc.org/no-dvc-cache>
Caches: local
Remotes: None
Workspace directory: ext4 on /dev/nvme0n1p2
Repo: dvc, git
Repo.site_cache_dir: /var/tmp/dvc/repo/7356c608e149ca636a5b0c11cf73fc9b

Best Tim

Originally posted by @TimOliverMaier in https://github.com/treeverse/dvc/discussions/11000