CYBERSECURITY
FEATURED ANALYSIS
npm Shrinkwrap reloaded: Locking npm Deps with Package-Lock and Yarn.Lock
SOURCE
Blog RSS Feed | Snyk
DATE
READ
1 min read
Locking or “pinning” dependencies is a widespread best practice in Ruby, Python, and other ecosystems. In Node.js locking was much less widespread, until recently, thanks to the improvements provided by package-lock.json …
Locking or “pinning” dependencies is a widespread best practice in Ruby, Python, and other ecosystems. In Node.js locking was much less widespread, until recently, thanks to the improvements provided by package-lock.json and yarn.lock. This post discusses how each of these solutions works and why you may want to use them.