FrontendHaltSecurity·Intermediate·Conceptual·1 min read
What does a committed lockfile with integrity hashes give you?
Short interview answer
It pins the exact resolved version of every direct and transitive dependency and records a content hash, so every install reproduces the exact tree that was tested and a tampered package fails the integrity check. Installing with the frozen or CI flag enforces this rather than allowing re-resolution.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.