Web Security · Junior · Question 74 of 75

Why should the lockfile (`package-lock.json`) be committed and installed with `npm ci` in CI?

1Because npm ci installs packages without downloading them
✓Correct answer: So every build gets exactly the same, reviewed dependency versions instead of newer, possibly compromised ones
3Because the lockfile encrypts all dependencies

Explanation

Without a lockfile, a version range can pull a freshly published malicious release. npm ci fails if the lockfile and package.json disagree.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.