Dependency lockfile

dependency-lockfileDeterministic

Every dependency manifest (npm, pnpm, yarn, pip, go, cargo, composer) has a committed lockfile next to it.

v1.0.2 · current

Version 1.0.2

Implementation sha256 Published CWE-1104

Verifies: Every dependency manifest (npm, pnpm, yarn, pip, go, cargo, composer, bundler) has a committed lockfile next to it; requirements.txt pins exact versions.
Inputs: File list of the checkout; manifest contents for requirements.txt. Paths listed in excludes (test, spec and tmp files, __tests__, __mocks__, fixtures, test, tests and audit-scripts folders) are never analysed.
Decision rule: FAIL when a manifest has no lockfile in the same folder (or a requirement is unpinned); PASS otherwise.
Type: deterministic

1.0.2: never analyses temporary files (*.tmp.*; spec.excludes follows AUDITOR_ANALYSIS_EXCLUDES). (1.0.1: never analyses test, spec, fixture and mock paths nor the auditor's own scripts (spec.excludes = AUDITOR_ANALYSIS_EXCLUDES); a fixture-looking secret (sk_test_, example, dummy) in real code is LOW, informative.)

const MANIFESTS = [

{ manifest: 'package.json', locks: ['package-lock.json', 'pnpm-lock.yaml', 'yarn.lock', 'bun.lock'] },

{ manifest: 'go.mod', locks: ['go.sum'] },

// ... one rule per ecosystem

];

// FAIL when a manifest folder has none of its lockfiles

The full script is disclosed on request in a read-only viewer (never published on GitHub); the attestation binds to this exact hash.