Source code
Code quality
Releases
Stability
No lockfile committed — installs are non-deterministic
Part of the Dependency supply chain check · fix arrives as a pull request
What it is
The repository has a package manifest but no committed lockfile, so dependency versions are resolved fresh at install time.
Why it matters
Every environment can resolve a different tree. Production installs a combination nobody has run, and a bug that appears only there cannot be reproduced locally because the local install is not the same.
How to fix it
Commit the lockfile your package manager produces and install with the frozen-lockfile flag in CI so a mismatch fails the build instead of silently resolving something new.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.