Checks · DEP-003

DEP-003 · No lockfile

Why it matters

Without a lockfile, two installs can pull different versions, including a broken or malicious one.

How we detect it

No package-lock, pnpm-lock, yarn.lock or bun.lock is present.

How we fix it

Generate a lockfile and commit it.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-007 · Source maps public in production
• DB-008 · Migrations not in repo
• HDR-001 · Missing HSTS
• HDR-002 · Missing CSP