Lockfile
A file that records the exact version and integrity hash of every package in a dependency tree, including its transitive dependencies. By pinning these resolved versions, the lockfile ensures that installing the same project on different machines or at different times produces an identical dependency tree, avoiding discrepancies caused by floating version ranges.
Core Facts
A lockfile is a dependency version snapshot file generated by package managers such as npm, pnpm, and yarn, commonly in the form of package-lock.json, pnpm-lock.yaml, or yarn.lock.
After a patch version is released, if the lockfile is not updated, the local environment may install the new version while CI is still on the old version, causing the problem of it running locally but erroring in the pipeline.
Timeline (last 90 days)
A lockfile is a dependency version snapshot file generated by package managers such as npm, pnpm, and yarn, commonly in the form of package-lock.json, pnpm-lock.yaml, or yarn.lock.
After a patch version is released, if the lockfile is not updated, the local environment may install the new version while CI is still on the old version, causing the problem of it running locally but erroring in the pipeline.
When upgrading adapter packages, lockfile changes should be committed at the same time, and a complete build and test should be executed in CI to confirm that hidden behavior changes are discovered in time.
A lockfile precisely records the exact version and integrity hash of every package across the entire dependency tree, ensuring a consistent dependency snapshot is installed across different environments.
All Facts (4)
A lockfile is a dependency version snapshot file generated by package managers such as npm, pnpm, and yarn, commonly in the form of package-lock.json, pnpm-lock.yaml, or yarn.lock.
75%VerifiedAfter a patch version is released, if the lockfile is not updated, the local environment may install the new version while CI is still on the old version, causing the problem of it running locally but erroring in the pipeline.
75%UnverifiedWhen upgrading adapter packages, lockfile changes should be committed at the same time, and a complete build and test should be executed in CI to confirm that hidden behavior changes are discovered in time.
50%UnverifiedA lockfile precisely records the exact version and integrity hash of every package across the entire dependency tree, ensuring a consistent dependency snapshot is installed across different environments.
50%