Definition. A lockfile records the exact resolved version of every direct and transitive dependency, with many tools also storing a cryptographic checksum of the artifact. Examples are composer.lock, package-lock.json and uv.lock. pip has checked such hashes in hash-checking mode since version 8.0.

Why it matters. Without a lockfile, every installation can resolve a different version, including one that has just been compromised. With a lockfile and checksums, a new version only enters the environment through a deliberate update, and a swapped artifact with the same version number fails the check. Updating the lockfile at the wrong moment does lock in a bad version, though. That is why a cooldown belongs with it.

Example. Environments that kept LiteLLM on an older version through a lockfile with hashes were untouched by the version 1.107.0 incident in October 2026.

Related. Cooldown, Image digest, Supply chain attack, SBOM