Unverified50% confidenceConceptExact time
A lockfile is a dependency version snapshot file generated by package managers such as npm, pnpm, and yarn, commonly in the form of package-lock.json, pnpm-lock.yaml, or yarn.lock.
1
Sources
50%
Confidence
Long-term
Relevance
10/14/2026
First Seen
Sources
Related Entities
Related Claims
VerifiedA lockfile (such as package-lock.json or pnpm-lock.yaml) records the exact version and integrity checksum hash of every package in the entire dependency tree, ensuring consistent installation results across different environments.71% similarUnverifiedDependency locking mechanisms in software supply chain security (such as npm's package-lock.json and Python's requirements.txt hash locking) alert against silent updates by fixing dependency versions and integrity fingerprints.69% similarUnverifiedIn high-frequency-iteration dependency libraries, committing and maintaining lock files (such as package-lock.json or pnpm-lock.yaml) ensures consistent dependencies across team members and CI environments.67% similarUnverifiednpm's package-lock.json locks the exact hash of every dependency, and npm audit interfaces with the NVD to automatically cross-reference known CVEs.67% similarUnverifiedpackage-lock.json等自动生成的锁文件动辄数千甚至上万行会虚高代码统计数字63% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1023746API
curl https://kongchang.com/api/v1/knowledge/claims/1023746MCP
get_claim(id=1023746)