Unverified50% confidenceFactExact time
Even if package.json is unchanged, lockfile changes may still affect the build output.
1
Sources
50%
Confidence
Long-term
Relevance
10/21/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedUsing lock files (package-lock.json or yarn.lock) can pin dependency versions and avoid inconsistency issues caused by version drift.79% similarUnverifiedAfter a patch upgrade, dependencies need to be reinstalled and integration tests run, because the lockfile does not automatically follow version changes in package.json.75% similarUnverified版本锁定文件（package-lock.json或yarn.lock）无法完全阻断供应链攻击，因为新建项目首次安装仍会拉取被污染版本，且自动化更新工具可能升级至恶意版本74% similarUnverifiedclaude-code-setup suggested a PreToolUse hook for this project that blocks direct editing of version-management-related files (manifest.json, src/version.js, package-lock.json, coverage/), because the project synchronizes the version numbers of three files via npm run version:*.70% similarUnverifiedPatch version changes generally do not affect the public API, but the versions in the dependency lockfile will change.69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1080638API
curl https://kongchang.com/api/v1/knowledge/claims/1080638MCP
get_claim(id=1080638)