Missing or Ignored Dependency Lockfile

Detects projects where lockfiles are missing or ignored in version control, allowing non-deterministic builds with potentially different dependency versions.

zakirkun 01755f0 2 files · 1.9 KB Updated

File contents

Missing or Ignored Dependency Lockfile

Overview

Lockfiles (package-lock.json, yarn.lock, Pipfile.lock, go.sum, Gemfile.lock) pin exact dependency versions. Without them, npm install may install newer versions that introduce vulnerabilities or malicious code.

Gitignoring lockfiles in application projects is a security anti-pattern.

Remediation

  • Commit lockfiles to version control for all application projects
  • Use npm ci instead of npm install in CI/CD
  • Verify lockfile integrity in CI with --frozen-lockfile

zakirkun/ice-tea/tree/main/skills/supply-chain/lockfile-missing commit 01755f0c76

Frequently asked questions

npx skillmds@latest add zakirkun/missing-or-ignored-dependency-lockfile