Know what you build with
Use lockfiles deliberately
Commit and review the ecosystem lockfile so local, CI, and production builds resolve the same dependency graph.
8 minute lesson
A version range describes allowed updates. A lockfile records the exact graph selected for this application.
Commit the supported lockfile and use deterministic install commands in CI. Review lockfile changes with the manifest change that caused them. Regenerate through the package manager rather than editing integrity and resolution fields by hand.
npm ci
git diff --exit-code package-lock.jsonA developer adds mailer with a version range and reviews version 3.2. CI resolves 3.3 the next morning because the lockfile was not committed. The source did not change, but the code entering the build did.
A frozen lockfile prevents that resolution drift. It does not cover a script that downloads latest.zip, and it does not prove that a locked package is trustworthy.
Run the frozen install command from a clean checkout and save the resolved dependency tree. Change one manifest range without updating the lockfile and show that the command fails. Also identify one build input, such as a remote binary or container base, that the lockfile does not control.
Lesson completed