Missing Lockfile resulting in unpinned dependencies

Verifies the presence of dependency management manifests (e.g., package.json, Gemfile, pyproject.toml, Pipfile, go.mod, etc.) without an accompanying lockfile that cryptographically pins dependencies (e.g., package-lock.json, Gemfile.lock, poetry.lock, Pipfile.lock, go.sum).

The Importance of Dependency Lockfiles for Consistent, Secure, and Predictable Dependency Management

Dependency lockfiles play a critical role in modern software development, allowing teams to create consistent, secure, and predictable environments across different stages of the software lifecycle. For developers, lockfiles aren’t just another file in a repository—they’re vital to maintain consistent builds, enhance security, and streamline collaboration. This article explores the importance of lockfiles, the benefits they bring, and the specific implementation across major programming languages.

Why Dependency Lockfiles Matter

1. Consistency Across Environments

Lockfiles record the exact versions of every dependency, along with sub-dependencies, that a project relies on. By storing these specific versions, lockfiles eliminate inconsistencies between environments (development, staging, production). When the same lockfile is used, developers can be confident that each installation recreates the exact same environment every time, reducing the risk of "works on my machine" issues.

2. Enhanced Security

Using dependency lockfiles is a strong security measure. Lockfiles help protect applications against dependency-related vulnerabilities by preventing unexpected updates that could introduce insecure versions. Security vulnerabilities in dependencies are common, and by controlling which versions are installed, you gain better control over security risks.

3. Improved Collaboration

For teams working on the same project, lockfiles ensure that every developer, regardless of local setup, works with identical dependency versions. This alignment is crucial for teams, enabling smoother collaboration and reducing friction when reviewing and merging code changes.

4. Software Bill of Materials (SBOM)

Lockfiles are essential for generating a Software Bill of Materials (SBOM), which is increasingly important for tracking software supply chains. For example, Trivy, a security scanner, can generate an SBOM for dependency security analysis, but it requires a lockfile to function effectively. Without such a file, the SBOM would not accurately reflect the project’s dependencies and their associated vulnerabilities as would be an incomplete and most likely incorrect picture of the reality in the production environment.

Where the Rule Looks for a Lockfile

A dependency manifest is reported when none of the lockfiles accepted for that manifest is found. The sections below list, for each language, the manifests that are checked and the lockfiles that satisfy them.

Some package managers keep a single lockfile above the projects it covers rather than beside each manifest. For those, the lookup starts in the directory holding the manifest and climbs to the repository root, so a workspace or monorepo carrying one lockfile at its root is not reported:

• Cargo.lock for the members of a Cargo workspace
• uv.lock for the members of a uv workspace
• cabal.project.freeze for a *.cabal package below the directory holding the freeze file
• *.deps.json and *Packages.props for .NET projects, covering a repository-wide Directory.Packages.props and build output written to a shared bin/ directory

Dependency Lockfiles Across Languages

JavaScript

• Manifest: package.json — a manifest declaring no dependencies is not reported
• Package Manager: npm / Yarn / pnpm / Bun
• Lockfile: package-lock.json or npm-shrinkwrap.json (npm), yarn.lock (Yarn), pnpm-lock.yaml (pnpm), bun.lock or bun.lockb (Bun)
• Generating/Maintaining:
• npm Documentation on package-lock.json
• npm Documentation on npm-shrinkwrap.json
• Yarn Documentation on yarn.lock
• pnpm Documentation on pnpm-lock.yaml
• Bun Documentation on bun.lock

Python

• Manifest: pyproject.toml, Pipfile
• Package Manager: Poetry / uv / PDM / pip / Pipenv
• Lockfile: poetry.lock, pdm.lock, pylock.toml or pyproject.lock next to a pyproject.toml, uv.lock at the project or at the workspace root above it, and Pipfile.lock next to a Pipfile. A requirements.txt is not accepted as a lockfile.
• Generating/Maintaining:
• Poetry Documentation on poetry.lock
• uv Documentation on uv.lock
• PDM Documentation on pdm.lock
• Python Packaging Specification for pylock.toml
• pip Documentation on pip lock
• Pipenv Documentation on Pipfile.lock

Go

• Manifest: go.mod
• Package Manager: Go Modules
• Lockfile: go.sum
• Generating/Maintaining:
• Go Modules Documentation on go.sum

Java

• Manifest: build.gradle, build.gradle.kts — Maven projects are not checked by this rule
• Package Manager: Gradle
• Lockfile: gradle.lockfile, buildscript-gradle.lockfile and gradle/verification-metadata.xml
• Generating/Maintaining:
• Gradle Documentation on Dependency Locking
• Gradle Documentation on Verification metadata

Scala

• Manifest: build.sbt
• Package Manager: sbt
• Lockfile: build.sbt.lock
• Generating/Maintaining:
• sbt Dependency Lock Plugin

.NET / C

• Manifest: *.csproj, *.fsproj, *.vbproj
• Package Manager: NuGet
• Lockfile: packages.lock.json, packages.config, a *.deps.json build output including one written under bin/, or a *Packages.props such as the Directory.Packages.props used for Central Package Management
• Generating/Maintaining:
• Microsoft's documentation
• NuGet Documentation on Central Package Management
• NuGet Documentation on packages.config

Ruby

• Manifest: Gemfile, gems.rb
• Package Manager: Bundler
• Lockfile: Gemfile.lock (for a Gemfile), gems.locked (for a gems.rb)
• Generating/Maintaining:
• Bundler Documentation on Gemfile.lock
• Bundler Documentation on gems.rb

PHP

• Manifest: composer.json
• Package Manager: Composer
• Lockfile: composer.lock, or vendor/composer/installed.json when the vendor directory is committed
• Generating/Maintaining:
• Composer Documentation on composer.lock
• Composer Documentation on Committing the vendor directory

Rust

• Manifest: Cargo.toml
• Package Manager: Cargo
• Lockfile: Cargo.lock, next to the crate or in any directory above it up to the repository root
• Generating/Maintaining:
• Cargo Documentation on Cargo.lock
• Cargo Documentation on Workspaces

Objective-C / Swift

• Manifest: Package.swift, Podfile
• Package Manager: CocoaPods, Swift Package Manager
• Lockfile: Podfile.lock (for a Podfile), Package.resolved (for a Package.swift)
• Generating/Maintaining:
• CocoaPods Documentation on Podfile.lock
• CocoaPods and Lockfiles (Route 85)
• Apple's Documentation on Package.resolved

Elixir

• Manifest: mix.exs
• Package Manager: Mix
• Lockfile: mix.lock
• Generating/Maintaining:
• Mix Documentation on Dependency Management

Dart

• Manifest: pubspec.yaml
• Package Manager: pub
• Lockfile: pubspec.lock
• Generating/Maintaining:
• Dart Documentation on pubspec.lock

C/C++

• Manifest: conanfile.txt, conanfile.py
• Package Manager: Conan
• Lockfile: conan.lock
• Generating/Maintaining:
• Conan Documentation on Lockfiles

Julia

• Manifest: Project.toml
• Package Manager: Pkg
• Lockfile: Manifest.toml
• Generating/Maintaining:
• Julia Pkg Documentation on Manifest.toml

Haskell

• Manifest: *.cabal, stack.yaml
• Package Manager: Cabal, Stack
• Lockfile: cabal.project.freeze (for a *.cabal, next to it or in any directory above it up to the repository root), stack.yaml.lock (for a stack.yaml)
• Generating/Maintaining:
• Cabal Documentation on cabal freeze
• Stack Documentation on Lock Files

R

• Manifest: DESCRIPTION
• Package Manager: renv
• Lockfile: renv.lock
• Generating/Maintaining:
• renv Documentation
• renv Documentation on the Lockfile

Steps to Create an SBOM with Trivy

For Trivy’s SBOM feature to work correctly, it’s essential to have an up-to-date lockfile. Lockfiles contain metadata required for generating an SBOM that accurately represents the project’s dependencies, versions, and potential security vulnerabilities.

Additional Resources

• Trivy Supported Languages