Lockfile Format Design and Tradeoffs | Andrew Nesbitt

Lockfile format tradeoffs, best practices, and a survey of existing formats across package managers. Lockfiles record which packages were installed, at what versions, from where, with what checksums. Most package managers have one: Gemfile.lock, package-lock.json, Cargo.lock, poetry.lock, pnpm-lock.yaml. (Go splits this across go.mod and go.sum.)

Source: nesbitt.io