-
Lockfiles contain a list of all the dependencies, both direct and indirect, of a package, pinned to exact versions. They are necessary though not sufficient for fully reproducible environments.
Ano…
-
There is a common mention/complaint that calling `pants generate-lockfiles ::` is slow. Creating this ticket to capture associated discussions, tickets, and even better, sample repos.
- https://gi…
-
## Describe the enhancement
I noticed that deno.lock isn't marked as generated. As I looked at the source code for marking things as generated, I wondered if there's a reason for individualizing ma…
-
As part of our security strengthening efforts:
- Packages *must* be pinned to a version (we should have tooling to enforce this) and lockfiles are a must.
- npm should use flag —frozen-lockfile
-
### What is your question?
Hi All
I recently started looking into conan2 lockfiles and I'm not sure one is supposed to evolve them over time.
particularly
1. Add dependencies
2. Remove depen…
-
# Introduction
The size of the Nixpkgs tarball places burden onto internet connections and storage systems of every user. We should therefore strive to keep it small. Over the past years that I've …
Atemu updated
2 weeks ago
-
Hello there,
`osv-scanner` currently does not support [conda lockfiles](https://google.github.io/osv-scanner/supported-languages-and-lockfiles/).
Conda lockfiles, called "environment" files, ca…
-
### What is your question?
The lockfiles by default always lock all dependencies including library dependencies of course but also build dependencies. Now, I can see why this makes sense as it locks …
-
Currently the deps.dev UI and APIs have a big percentage of python versions maybe 20-30% which have no known dependencies.
For Python specifically, this is mostly due to lack of support for setup.py,…
-
Dear Conan team,
earlier with Conan 1 a lockfile contained the full reference incl. pkgid and prev.
With Conan 2.0.x this information is not anymore in the lockfile by default. But you provided …