| name | read-a-package-lockfile |
| category | code |
| description | Read a package lockfile to identify resolved versions, dependency paths, integrity, sources, platforms, and unexpected changes. Use when reviewing installation, upgrade, vulnerability, or supply-chain evidence. |
read-a-package-lockfile
Read the lockfile with the package manager and format that produced it.
When to use
- Use during dependency review, incident analysis, reproducibility checks, or merge review.
- Do not edit generated lock entries manually unless the package manager explicitly supports it.
Preconditions
- Identify manifest, lock format and version, package manager and version, registries, workspace, and target platforms.
Procedure
- Preserve the lockfile and compare it to the relevant base revision.
- Identify direct requirements and each resolved transitive path.
- Inspect version, source, registry or URL, integrity, optionality, peer, platform, and lifecycle metadata.
- Explain duplicate versions and resolution overrides.
- Flag new sources, git URLs, local paths, missing integrity, scripts, and surprising transitive growth.
- Reproduce installation in a clean authorized environment without updating the lock.
- Record findings and regenerate through the correct package-manager command when change is approved.
Failure plan
- If the format or package-manager version is unknown, do not infer fields from another ecosystem.
Worked example
A minor direct upgrade introduces a git-sourced transitive package with an install script; the reviewer traces its path and blocks release pending provenance.
Done
- A lockfile review report records format, versions, paths, sources, integrity, duplicates, scripts, diff, and findings
- Clean-install, manifest, package-manager-version, registry, platform, provenance, and lock-stability checks verify interpretation
