Lockfile
A generated file recording the exact dependency versions an install resolved to.
A lockfile records the exact resolved version of every direct and transitive dependency, so that installing from it reproduces the same tree on every machine. Manifests state ranges; lockfiles state facts. Committing one is what makes builds reproducible.
Lockfiles are generated artifacts and should be treated as such: regenerate rather than hand-edit, and review the diff for surprises rather than for style.
One structural detail causes recurring confusion. Lockfiles typically contain two kinds of information: an echo of the declared ranges from every manifest, and the map of resolved packages. Tightening a range in a manifest necessarily changes the first, so "the lockfile diff must be empty" is an impossible standard — the honest check is whether the resolved half changed. Diffing the resolution section alone distinguishes an intentional pin from an unintended re-resolution.
A second: how installed packages are laid out on disk is a property of the package manager's linking strategy, not of the lockfile, so reading a version out of an installed directory may be wrong or may find nothing. The lockfile's resolution map is the answer. See Package Manager and Monorepo.
See also8
Semantic Versioning
A version-numbering convention where the number communicates the kind of change.
Version Control & Delivery22 connections
Determinism
The property that identical inputs produce identical outputs, and the foundation of caching and verification.
Systems & Tooling61 connections
Supply Chain Security
Protecting against compromise arriving through the code and tooling a project depends on.
Version Control & Delivery24 connections
Bundler
The tool that resolves an application's modules into the files a browser downloads.
Web Platform18 connections
Silent Failure
A failure that produces no signal, so the absence of an error reads as success.
Method73 connections
Module Graph
The directed graph of imports that decides what code ends up where.
Web Platform22 connections
Gitignore
The file of patterns telling Git which files to leave untracked, such as build output, dependencies, editor clutter, and local secrets, along with the traps of files that were already tracked and secrets already committed.
Version Control & Delivery12 connections
Automated Dependency Updates
Bots that open pull requests whenever a dependency releases a new version, how they keep upgrades small and security patches fast, and how they turn into noise or a supply-chain risk when misconfigured.
Version Control & Delivery11 connections
Linked from10
- API Translation LayerGraphics & Rendering
Software that implements one platform's API on top of another's, so unmodified programs run somewhere they were never built for.
- Artifact RepositoryVersion Control & Delivery
The store for the built outputs of software, such as packages, container images, and binaries, so the exact thing that was tested is the exact thing that ships.
- Automated Dependency UpdatesVersion Control & Delivery
Bots that open pull requests whenever a dependency releases a new version, how they keep upgrades small and security patches fast, and how they turn into noise or a supply-chain risk when misconfigured.
- CopyleftVersion Control & Delivery
A licensing strategy that uses copyright to require derivative works to stay open.
- Git HookVersion Control & Delivery
Scripts Git runs automatically at points such as committing or pushing, used to check formatting and messages locally, and on servers to enforce policy or trigger deploys.
- GitignoreVersion Control & Delivery
The file of patterns telling Git which files to leave untracked, such as build output, dependencies, editor clutter, and local secrets, along with the traps of files that were already tracked and secrets already committed.
- MonorepoSystems & Tooling
Several packages developed in one repository with shared tooling and atomic cross-package changes.
- Package ManagerSystems & Tooling
The tool that resolves, fetches, and installs dependencies, and pins them for reproducibility.
- Semantic VersioningVersion Control & Delivery
A version-numbering convention where the number communicates the kind of change.
- Supply Chain SecurityVersion Control & Delivery
Protecting against compromise arriving through the code and tooling a project depends on.