Glossary / Lockfiles
Lockfiles
A lockfile records a package manager's resolved dependency graph, including concrete package versions and integrity/source metadata, so collaborators and CI can reproduce the selected tree from a manifest. It complements rather than replaces package.json: the manifest states acceptable dependency intent, while the lock captures a resolution for a particular manager and format.
How they work
A lockfile may include transitive package versions, dependency edges, registry URLs, integrity hashes, peer-resolution choices, workspace links, and platform metadata. It is package-manager-specific; npm, pnpm, and Yarn lockfiles are not interchangeable. Lockfiles do not always guarantee byte-for-byte identical node_modules across OS, architecture, package-manager versions, or optional native dependencies, but they greatly constrain resolution.
For npm, npm ci installs from a lock without updating it and fails when the manifest and lock disagree. pnpm offers frozen-lockfile behavior; modern Yarn uses immutable installation and Yarn Classic has its own frozen flag. Lock updates should be intentional and reviewed as dependency graph changes, not treated as noise.
Maintenance and security
Commit the authoritative lockfile for applications and most libraries with reproducible CI expectations. Do not hand-edit it; use the package manager. Avoid committing competing lockfiles that cause contributor and automation disagreement. Review large diffs, new transitive packages, registry/source changes, and integrity changes. A lockfile can faithfully reproduce a vulnerable or compromised dependency, so reproducibility is not a security guarantee.
Interview questions
- Manifest vs lockfile? Manifest describes ranges and package metadata; lockfile records a concrete resolved graph.
- Why should CI use a frozen install? It detects drift and avoids silently changing the reviewed graph.
- Are lockfiles portable across package managers? No; each format captures manager-specific resolution details.
- Does a lockfile guarantee identical binaries everywhere? No; platform-specific optional/native builds and toolchain differences remain.
- How handle lockfile conflicts? Resolve with the designated package manager, inspect graph changes, and commit the regenerated file.