What is Lockfile?

A file that pins the exact versions of every package, so installs don't change silently.

Where Lockfile goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

  • Keeping it running · 4 minutes · Pro

    Update everything, deploy nothing

    You asked your AI to 'update everything to the latest versions'. The app runs on your laptop, but the deploy fails and the live site is stuck on the old version.

    Why does my build fail after updating packages?

    Usually because a package jumped a major version, which can change how it works, or because package.json and the lockfile no longer match, so the build server installs different versions than your laptop or refuses to install. Update one package at a time, read upgrade notes for major versions, and commit the lockfile with package.json.

    Read the fix

  • Working with your AI agent · 4 minutes · Pro

    The package that did not exist

    Your AI adds a package called 'next-auth-helpers-pro' to fix sign-in. The install prints a lot of output you do not recognise.

    Can an AI suggest a malicious npm package?

    Yes. AI models sometimes invent plausible package names, and attackers register those names with malicious code, an attack called slopsquatting. Installing a package can run its scripts immediately. Before installing an unfamiliar package, check it is real, widely used, linked to a real repository and has no unexpected install scripts.

    Read the fix

Related terms

Git, commit, repository
Git saves snapshots (commits) of your code in a repository, so you can see history and go back.
Package
Code someone else wrote that your app installs and uses. Installing it runs their code on your machine.
Server
A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Secret key
A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.
Production
The real, live version of your app that customers use, as opposed to the copy on your laptop.
Deploy
Putting a new version of your app online so users get it.

All 62 terms in the glossary