Unverified50% confidenceFactExact time
package-lock.json or pnpm-lock.yaml records the resolved exact version tree; when the lockfile is unchanged, npm install will not pull new patches.
1
Sources
50%
Confidence
Long-term
Relevance
10/27/2026
First Seen
Sources
Related Entities
Related Claims
Unverifiednpm install will automatically update dependencies when the lockfile is inconsistent with package.json, which may introduce untested versions.79% similarVerifiedIt is recommended to use package-lock.json or pnpm-lock.yaml to precisely lock the actually installed versions, and to submit upgrade PRs on a scheduled basis via tools such as Dependabot or Renovate.76% similarUnverified版本锁定文件（package-lock.json或yarn.lock）无法完全阻断供应链攻击，因为新建项目首次安装仍会拉取被污染版本，且自动化更新工具可能升级至恶意版本72% similarUnverifiedEven if the version declaration of @ai-sdk/xai allows upward compatibility, as long as the lock file is not updated, the actually installed @ai-sdk/provider-utils may still be an old version; only running commands such as npm update will truly rewrite the lock file and pull the new version.71% similarUnverifiedclaude-code-setup suggested a PreToolUse hook for this project that blocks direct editing of version-management-related files (manifest.json, src/version.js, package-lock.json, coverage/), because the project synchronizes the version numbers of three files via npm run version:*.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1105084API
curl https://kongchang.com/api/v1/knowledge/claims/1105084MCP
get_claim(id=1105084)