A dependency manifest describes requested packages; a lockfile records a more precise resolution for a particular ecosystem. Understanding the difference helps explain why two apparently similar installations can behave differently.
Separate requested ranges from resolved versions
A manifest can allow a range of versions, while the lockfile records the resolved dependency tree and associated metadata. Transitive dependencies matter too. When diagnosing a change, inspect both the direct package and the resolved graph rather than assuming the top-level package list describes the entire installation.
Use the package manager’s intended workflow
For an npm project with a consistent lockfile, npm ci is designed for clean automated installation and fails when package metadata and the lockfile disagree. It is not a command to casually run in an unrelated directory. Different ecosystems have different lockfile and installation rules, so use the documentation for the tool actually present in the repository.
Review dependency changes like code changes
A lockfile reduces one source of variation; it does not guarantee that every platform, runtime or external service behaves identically. Review update scope, compatibility and security information, then run relevant checks. Keep credentials in private configuration and avoid pasting package-manager authentication tokens into shared logs.
Worked example
A fictional pull request updates one direct package but changes several transitive packages in the lockfile. A useful review explains that resolution, checks compatibility with the project runtime and verifies the application path that uses the package.
Check your understanding
Try each question before opening its explanation. These are free practice prompts; they do not use game chances.
Does a lockfile contain only direct dependencies?
No. It can record the resolved dependency tree, including packages brought in by other packages. The exact representation depends on the package manager.
Does a lockfile prove an installation is secure?
No. It records a resolution. Security, provenance, platform assumptions and the code’s behaviour still need appropriate review and verification.
What should happen if npm ci finds a manifest-lockfile mismatch?
It should fail rather than silently creating a different resolution. Repair and review the intended package metadata through the proper development workflow, then rerun the automated install.
Sources and further reading
These original examples explain foundational concepts. Use the official references for complete, current details and version-specific behaviour.
About this guide: AI-assisted educational content with original examples and linked primary references. Found an issue? Tell us what to improve.