lockfile

A set of tools to keep your pinned Python dependencies fresh.

Lint an npm or yarn lockfile to analyze and detect security issues

Fast, resilient, reproducible builds with npm install.

Lightweight lockfile for conda environments

An inter-process and inter-machine lockfile utility that works on a local or network file system.

The missing `yarn audit fix`

🔒 Your lockfile, up to date, all the time

A gh CLI extension that generates and verifies the GitHub Actions dependency lockfile, pinning every action your workflows use to an exact commit.

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed, --min-age cooling-off gate, exit 4 when a scan is incomplete. SLSA L3, Sigstore-signed feed.

Handle locking via pid files

hatch plugin to use pip-compile (or uv) to manage project dependencies and lockfiles

Lean, Bundler-compatible gem manager written in Go

A plugin for Tox that lets you install test environment dependencies from the Poetry lockfile

A Poetry plugin to support monorepo setups for Python, enabling shared lockfiles and directory dependency pinning.

A simple pip freeze workflow for Python application developers

Heavily tested, but simple filelocking solution using flock command.

Declarative, reproducible plugin manager and curated distro for Herdr — one list, a lockfile, and a safe manage pane.

A simple Bash lock file library.

Use `npx aud` instead of `npm audit`, whether you have a lockfile or not!

Add missing integrity and resolved fields to a package-lock.json file