Unverified50% confidenceCautionExact time
npm install will automatically update dependencies when the lockfile is inconsistent with package.json, which may introduce untested versions.
1
Sources
50%
Confidence
Long-term
Relevance
9/29/2026
First Seen
Sources
Related Entities
Related Claims
Unverified版本锁定文件（package-lock.json或yarn.lock）无法完全阻断供应链攻击，因为新建项目首次安装仍会拉取被污染版本，且自动化更新工具可能升级至恶意版本68% similarUnverifiedPatch version updates are generally backward compatible and can be upgraded via npm update @ai-sdk/zai or the equivalent package manager command.65% similarUnverifiedOnly when the upper-layer dependent packages simultaneously release updates can end users obtain upstream low-level package fixes via the npm update command.64% similarUnverifiedUsing lock files (package-lock.json or yarn.lock) can pin dependency versions and avoid inconsistency issues caused by version drift.63% similarUnverifiedIn production environments, it is recommended to use a lockfile (such as pnpm-lock.yaml) to pin exact versions, avoiding unexpected behavioral changes introduced by automatic upgrades.62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/958769API
curl https://kongchang.com/api/v1/knowledge/claims/958769MCP
get_claim(id=958769)