The latest articles on DEV Community by Morgan Griffin (@morgantinkers). https://dev.to/morgantinkers https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4214150%2Ff746f127-21c1-4bf6-acd9-292d5ca0f3c8.jpg https://dev.to/morgantinkers en Morgan Griffin Thu, 29 Oct 2026 02:37:11 +0000 https://dev.to/morgantinkers/the-lock-file-is-the-contract-4lnj https://dev.to/morgantinkers/the-lock-file-is-the-contract-4lnj <p>Spent a day on a CI build that worked locally and failed on the runner. Same Node version, same lock file, different result.</p> <p>A transitive dependency published a patch between our two installs, and only one had it pinned. The lock file existed, but one pipeline step ran an install that ignored it.</p> <p>The fix was one flag. The lesson: a lock file only works if every install path respects it.</p> dependencies javascript tooling