[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"glossary-lockfile::en":3,"gloss-cluster-lockfile::en":26,"gloss-next-lockfile::en":9},{"slug":4,"category":5,"name":6,"definition":7,"meta_desc":8,"faq":9,"schema_markup":9,"related":10},"lockfile","dev-tools","Lockfile","A lockfile records the exact version of every dependency — direct and transitive — that a package manager resolved for a project, usually with a content hash for each. The manifest states what you want (\"a 4.x release of this library\"); the lockfile states what you got, down to the transitive dependency six levels deep that nobody chose deliberately. Committing it is what makes an install reproducible: the same commit produces the same dependency tree on a laptop, in CI and in the production image, instead of resolving fresh each time and picking up whatever was published in the meantime. That reproducibility carries three consequences worth stating. Debugging becomes possible, because \"works locally, fails in CI\" stops being a mystery when both are provably running the same code. Supply-chain review becomes possible, because the lockfile is the authoritative list a scanner matches against published vulnerabilities, and the recorded hashes detect a package whose contents changed without a version bump. And upgrades become deliberate: dependencies move when someone runs an update and reviews the diff, rather than silently on the next build. Two practices go with it. Use the installer command that respects the lockfile exactly and fails on mismatch rather than the one that resolves and rewrites, since only the strict form gives the guarantee in CI. And do not let it drift for months — a lockfile that is never updated accumulates known vulnerabilities and eventually turns a routine upgrade into a large, risky one.","A lockfile pins the exact resolved version and hash of every dependency — what it makes reproducible, and why strict installs and regular updates both matter.",null,[11,14,17,20,23],{"slug":12,"name":13},"cve","CVE (Common Vulnerabilities and Exposures)",{"slug":15,"name":16},"package-manager","Package Manager",{"slug":18,"name":19},"semantic-versioning","Semantic Versioning (SemVer)",{"slug":21,"name":22},"software-bill-of-materials","Software Bill of Materials (SBOM)",{"slug":24,"name":25},"supply-chain-security","Software Supply-Chain Security",[27,31,34,38,41,44,47,50,53,56,59,62],{"slug":28,"category":5,"name":29,"updated_at":30},"agent","Agent","2026-08-24T02:46:36+00:00",{"slug":32,"category":5,"name":33,"updated_at":30},"ai-code-assistant","AI Coding Assistant",{"slug":35,"category":5,"name":36,"updated_at":37},"api-gateway","API Gateway","2026-08-24T02:46:37+00:00",{"slug":39,"category":5,"name":40,"updated_at":37},"api-versioning","API Versioning",{"slug":42,"category":5,"name":43,"updated_at":30},"autonomous-agent","Autonomous Agent",{"slug":45,"category":5,"name":46,"updated_at":37},"blue-green-deployment","Blue-Green Deployment",{"slug":48,"category":5,"name":49,"updated_at":37},"canary-deployment","Canary Deployment",{"slug":51,"category":5,"name":52,"updated_at":37},"chaos-engineering","Chaos Engineering",{"slug":54,"category":5,"name":55,"updated_at":30},"ci-cd","Continuous Integration \u002F Continuous Deployment (CI\u002FCD)",{"slug":57,"category":5,"name":58,"updated_at":37},"circuit-breaker","Circuit Breaker",{"slug":60,"category":5,"name":61,"updated_at":37},"cli","Command-Line Interface (CLI)",{"slug":63,"category":5,"name":64,"updated_at":37},"cloud-development-environment","Cloud Development Environment (CDE)"]