tooling/one-lockfile

Why

Two lockfiles (package-lock.json and pnpm-lock.yaml) disagree about versions, so developers, CI and production install different code. A missing lockfile, or a CI install that may update it, lets a new and possibly compromised version slip in between review and deploy.

Fix

Keep the lockfile of the package manager in packageManager (or the one the team uses), delete the others, commit it, and install in CI with npm ci, pnpm install --frozen-lockfile, yarn install --immutable or bun install --frozen-lockfile.

Examples

# good: CI
corepack enable 2>/dev/null; pnpm install --frozen-lockfile

Sources

• npm CLI documentation, npm ci
• Node.js, Corepack (packageManager field)

Read it in the terminal

npx github:dawidolko/frontend-skills explain tooling/one-lockfile