PPDF BOOK SEARCH
PDF document

FAQ for lockfiles

Working with JavaScript/TypeScript often involves dealing with lockfiles such as package-lock.json, yarn.lock, or pnpm-lock.yaml. This FAQ draws from my experience working primarily with npm -based projects.

Source: okenlabs.com

Open / Download at sourceReport this link

Related files to “faq-for-lockfiles”

PDF

What is project.lock.json? | Codemia

project.lock.json was the dependency lock file generated by the early project.json era of .NET Core tooling. Its job was to record the exact package graph chosen during restore so builds stayed predictable across machines, target frameworks, and runtimes.

PDF

Node Audit Analyzer – OWASP Dependency-Check

The analyzer submits the lock files to the NPM Audit API for analysis, returning a list of advisories which get incorporated into the dependency check reports. This analyzer is enabled by default and requires that the machine performing the analysis can reach out to the Internet.

PDF

Lockfile Format Design and Tradeoffs | Andrew Nesbitt

Lockfile format tradeoffs, best practices, and a survey of existing formats across package managers. Lockfiles record which packages were installed, at what versions, from where, with what checksums. Most package managers have one: Gemfile.lock, package-lock.json, Cargo.lock, poetry.lock, pnpm-lock.yaml. (Go splits this across go.mod and go.sum.)