Unverified50% confidenceTradeoffExact time
When the package version declared in pyproject.toml drifts from the record in the lock file, it may cause inconsistent behavior between local and CI environments.
1
Sources
50%
Confidence
Long-term
Relevance
10/8/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedPixi的锁文件（pixi.lock）递归记录所有传递依赖的精确版本号和SHA256内容哈希值56% similarUnverifiedIn high-frequency-iteration dependency libraries, committing and maintaining lock files (such as package-lock.json or pnpm-lock.yaml) ensures consistent dependencies across team members and CI environments.55% similarUnverifiedFixed a security issue where Edit/Write/Read permission rule paths containing parentheses caused rules to be deemed invalid or ignored by the Bash sandbox, resulting in read-only folders actually being writable55% similarUnverifiedv2.1.292 fixes a security issue where the PreToolUse hook approval and auto mode could bypass permission prompts when reading files from network (UNC) paths.55% similarUnverifiedPyPI 历史上多次出现 typosquatting 攻击，恶意发布者注册与知名库名称相似的包名诱导开发者错误安装含恶意代码的包54% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/986693API
curl https://kongchang.com/api/v1/knowledge/claims/986693MCP
get_claim(id=986693)