lockfile

A lockfile is an auto-generated record that pins down the exact version of every single piece of code your project installs — not just the libraries you asked for, but the libraries those libraries needed too. Its whole job is to make 'install' give the same result every time, on every machine.

Here's the gap it fills. In your manifest you usually say something loose like 'give me version 4-point-anything of lodash'. That's convenient, but it means two people installing on different days could quietly end up with slightly different code. The lockfile freezes the answer: it writes down that you actually got 4.17.21, this exact one, from this exact source.

You don't write a lockfile by hand — your package manager generates and updates it. You just need to commit it alongside your code. Then a teammate, or a build server, or future-you runs one install command and gets a byte-for-byte identical setup, instead of a vague 'should be close enough'.