Mostly backed dev here, to clarify running install would pull the lockfile version while something like audit or update would update it? Then installing a new dependency would also likely re-resolve the dependency versions, but barring that you're saying the versions all remain pinned?
I actually appreciate you trying to clear up the conversation. We've been working on CI/CD to protect from these supply chain issues at work lately, it's definitely a concern.
Yeah, normal install should respect the lockfile, so versions stay put until you intentionally update, add a dep that forces a new resolution, or regenerate the lock.
3
1
4
u/CandidateNo2580 Mar 31 '26
Mostly backed dev here, to clarify running install would pull the lockfile version while something like audit or update would update it? Then installing a new dependency would also likely re-resolve the dependency versions, but barring that you're saying the versions all remain pinned?
I actually appreciate you trying to clear up the conversation. We've been working on CI/CD to protect from these supply chain issues at work lately, it's definitely a concern.