Tag
lockfiles
- May 16, 2026 Lockfiles: Recording the Resolved Graph Without Re-Resolving It What a lockfile stores beyond version numbers, how it stays consistent with the manifest, and why regeneration is a different operation from installation. software engineering
- Dec 5, 2025 How Dependency Resolvers Turn Version Ranges into a Fixed Graph A manifest states constraints, not versions. Resolution is a search over the version space, and the lockfile is the memoized answer that makes a build repeatable. security
- Jul 29, 2025 Lockfiles and How a Version Range Becomes a Tree Why a range in a manifest is not a pin, what a lockfile records that the manifest cannot, and how resolvers settle or fail on conflicting requirements. devops
- Feb 25, 2025 What a SHA-512 Integrity Hash in Package Metadata Actually Proves Subresource Integrity, package lockfile digests, and Go checksums look alike but answer different questions about who computed the hash and what it covers. security
- Nov 14, 2024 Lockfiles, Hash Pinning, and Reconstructed Environments How a resolved dependency graph is recorded with content hashes, what the installer guarantees on a rebuild, and where the reconstruction stops being faithful. scientific computing
- Feb 3, 2024 Lockfiles as Reproducibility Contracts and Why They Drift What a lockfile must record to make an install repeatable, which inputs it cannot capture, and how lockfiles fall out of sync with manifests without either side being wrong. language runtimes
- Nov 16, 2023 Lockfile Determinism, Diffs, and Merge Conflicts Why two resolutions of the same inputs should produce identical bytes, which writer choices break that, and why merging lockfiles textually is unsound even when it usually appears to work. developer tools
- Jun 23, 2023 What a Lockfile Records and What It Leaves Out How a lockfile turns one resolution result into an artifact the installer can consume without a solver, which facts it must store, and how an install checks that it still matches the manifest. developer tools