lockfile

A set of tools to keep your pinned Python dependencies fresh.

Lint an npm or yarn lockfile to analyze and detect security issues

Fast, resilient, reproducible builds with npm install.

Lightweight lockfile for conda environments

An inter-process and inter-machine lockfile utility that works on a local or network file system.

The missing `yarn audit fix`

🔒 Your lockfile, up to date, all the time

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed, --min-age cooling-off gate, exit 4 when a scan is incomplete. SLSA L3, Sigstore-signed feed.

Handle locking via pid files

hatch plugin to use pip-compile (or uv) to manage project dependencies and lockfiles

Lean, Bundler-compatible gem manager written in Go

A plugin for Tox that lets you install test environment dependencies from the Poetry lockfile

A Poetry plugin to support monorepo setups for Python, enabling shared lockfiles and directory dependency pinning.

A gh CLI extension that generates and verifies the GitHub Actions dependency lockfile, pinning every action your workflows use to an exact commit.

A simple pip freeze workflow for Python application developers

Heavily tested, but simple filelocking solution using flock command.

A simple Bash lock file library.

Tool for smart revert of integrity changes for npm lock file

Add missing integrity and resolved fields to a package-lock.json file

Use `npx aud` instead of `npm audit`, whether you have a lockfile or not!