at least pnpm resolves lockfile merge conflicts for me i guess
November 8, 2026 at 5:05 AM
at least pnpm resolves lockfile merge conflicts for me i guess
The numbers:
✅ 14.9s average install vs 18.2s on npmjs.org (1.22× faster)
✅ fresh install, no lockfile: 15.9s vs 25.5s (1.60× faster)
✅ faster than every paid option we tested: JFrog 26.6s, GitHub Packages 41.3s, AWS CodeArtifact 50.6s, Cloudsmith 62.9s
/3
✅ 14.9s average install vs 18.2s on npmjs.org (1.22× faster)
✅ fresh install, no lockfile: 15.9s vs 25.5s (1.60× faster)
✅ faster than every paid option we tested: JFrog 26.6s, GitHub Packages 41.3s, AWS CodeArtifact 50.6s, Cloudsmith 62.9s
/3
https://npmjs.org
npmjs.org
November 9, 2026 at 3:19 PM
The numbers:
✅ 14.9s average install vs 18.2s on npmjs.org (1.22× faster)
✅ fresh install, no lockfile: 15.9s vs 25.5s (1.60× faster)
✅ faster than every paid option we tested: JFrog 26.6s, GitHub Packages 41.3s, AWS CodeArtifact 50.6s, Cloudsmith 62.9s
/3
✅ 14.9s average install vs 18.2s on npmjs.org (1.22× faster)
✅ fresh install, no lockfile: 15.9s vs 25.5s (1.60× faster)
✅ faster than every paid option we tested: JFrog 26.6s, GitHub Packages 41.3s, AWS CodeArtifact 50.6s, Cloudsmith 62.9s
/3
Pinning the package in package.json and rechecking the lockfile after updates usually stops that newer-than-available loop.
November 6, 2026 at 8:15 PM
Pinning the package in package.json and rechecking the lockfile after updates usually stops that newer-than-available loop.
✓ Lockfile passes supply-chain policies (1475 entries in 3.7s)
November 8, 2026 at 3:27 PM
✓ Lockfile passes supply-chain policies (1475 entries in 3.7s)
Have you onboarded a workflow to a lockfile yet? What tripped you up first?
November 8, 2026 at 2:04 AM
Have you onboarded a workflow to a lockfile yet? What tripped you up first?
2/ Lockfile commits lock providers into specific versions, blocking legitimate patch updates and making dependency drift between environments inevitable.
November 9, 2026 at 11:01 AM
2/ Lockfile commits lock providers into specific versions, blocking legitimate patch updates and making dependency drift between environments inevitable.
💫 Ork: платформа для создания постоянных ботов с общим чатом
Ork — это открытая платформа для разработки и запуска персональных ботов с совместным чатом и веб-приложением. Инструкция по установке и запуску.
• Установите Node.js версии 22.22.2+ или выше
• corepack pnpm install --frozen-lockfile дл…
Ork — это открытая платформа для разработки и запуска персональных ботов с совместным чатом и веб-приложением. Инструкция по установке и запуску.
• Установите Node.js версии 22.22.2+ или выше
• corepack pnpm install --frozen-lockfile дл…
November 7, 2026 at 5:40 AM
💫 Ork: платформа для создания постоянных ботов с общим чатом
Ork — это открытая платформа для разработки и запуска персональных ботов с совместным чатом и веб-приложением. Инструкция по установке и запуску.
• Установите Node.js версии 22.22.2+ или выше
• corepack pnpm install --frozen-lockfile дл…
Ork — это открытая платформа для разработки и запуска персональных ботов с совместным чатом и веб-приложением. Инструкция по установке и запуску.
• Установите Node.js версии 22.22.2+ или выше
• corepack pnpm install --frozen-lockfile дл…
Oof, two months of work. If it's in git, compare against the last commit that worked (git diff) and have Claude Code fix only that difference. Then pin your package versions (requirements.txt or a lockfile) so the next update can't quietly break the voice part again.
November 7, 2026 at 8:04 PM
Oof, two months of work. If it's in git, compare against the last commit that worked (git diff) and have Claude Code fix only that difference. Then pin your package versions (requirements.txt or a lockfile) so the next update can't quietly break the voice part again.
How to remove corepack
https://github.com/misskey-dev/misskey/commit/83c3bb839f50fc24f667611f6852db3b14bd05e6
https://github.com/misskey-dev/misskey/commit/83c3bb839f50fc24f667611f6852db3b14bd05e6
deps: update pnpm to v10 (#15588) · misskey-dev/misskey@83c3bb8
* Revert "fix(build): corepackのバグの回避 (#15387)" This reverts commit 9c70a4e63130f85d191c5bc16d0a4be5cd1dece2. * deps: update pnpm to v10 * fix broken lockfile * update changelog * fix...
github.com
November 6, 2026 at 9:02 AM
How to remove corepack
https://github.com/misskey-dev/misskey/commit/83c3bb839f50fc24f667611f6852db3b14bd05e6
https://github.com/misskey-dev/misskey/commit/83c3bb839f50fc24f667611f6852db3b14bd05e6
Fix forward works when the only person waiting on the fix is you. In a library, the bug you ship today sits in someone's lockfile for months. The people who depend on you can't fix forward. They can only pin and wait.
November 5, 2026 at 3:14 PM
Fix forward works when the only person waiting on the fix is you. In a library, the bug you ship today sits in someone's lockfile for months. The people who depend on you can't fix forward. They can only pin and wait.
What GitHub Actions lockfiles mean for your CI
GitHub Actions can now run the exact commits recorded in a lockfile, including hidden nested actions. Here is what that protects, and what it does not.
GitHub Actions can now run the exact commits recorded in a lockfile, including hidden nested actions. Here is what that protects, and what it does not.
What GitHub Actions lockfiles mean for your CI
GitHub Actions can now run the exact commits recorded in a lockfile, including hidden nested actions. Here is what that protects, and what it does not.
pickuma.com
November 6, 2026 at 10:50 PM
What GitHub Actions lockfiles mean for your CI
GitHub Actions can now run the exact commits recorded in a lockfile, including hidden nested actions. Here is what that protects, and what it does not.
GitHub Actions can now run the exact commits recorded in a lockfile, including hidden nested actions. Here is what that protects, and what it does not.
GhostAction targeted 30,000+ GitHub repos in October with a fake "Security Audit" workflow (GitGuardian).
Revoke the stolen credential, not just the secrets. Then lock your actions: gh actions-lock
Search for security-audit.yml today.
Follow for more.
#GitHubActions
Revoke the stolen credential, not just the secrets. Then lock your actions: gh actions-lock
Search for security-audit.yml today.
Follow for more.
#GitHubActions
November 8, 2026 at 2:03 AM
GhostAction targeted 30,000+ GitHub repos in October with a fake "Security Audit" workflow (GitGuardian).
Revoke the stolen credential, not just the secrets. Then lock your actions: gh actions-lock
Search for security-audit.yml today.
Follow for more.
#GitHubActions
Revoke the stolen credential, not just the secrets. Then lock your actions: gh actions-lock
Search for security-audit.yml today.
Follow for more.
#GitHubActions
Why lockfile hashes instead of just pinning versions—do you actually hit registry drift that badly in practice?
November 5, 2026 at 12:40 AM
Why lockfile hashes instead of just pinning versions—do you actually hit registry drift that badly in practice?
Pinning the lockfile, the runtime and the SDK, then varying only the model, makes a failed replay mean something. Do you store that pin set with each run's record, or rebuild it from the repo at replay time?
November 4, 2026 at 4:11 PM
Pinning the lockfile, the runtime and the SDK, then varying only the model, makes a failed replay mean something. Do you store that pin set with each run's record, or rebuild it from the repo at replay time?
A transitive dependency sat in your lockfile for months with a known RCE and a patch that shipped 13 months earlier. Dependency review gates fix that. https://www.valtersit.com/guides/ci_cd/dependency-review-gates-block-prs-on-known-cves/
Dependency Review Gates: Block PRs on Known CVEs
www.valtersit.com
November 9, 2026 at 4:40 PM
A transitive dependency sat in your lockfile for months with a known RCE and a patch that shipped 13 months earlier. Dependency review gates fix that. https://www.valtersit.com/guides/ci_cd/dependency-review-gates-block-prs-on-known-cves/
Agree, with one catch: a deterministic check is only as good as what it pins. Record the compiler, test runner, and lockfile with each pass, or "green" quietly means something different next week. A flaky test is the worst case: a hard check that behaves like a conversation.
November 8, 2026 at 11:06 PM
Agree, with one catch: a deterministic check is only as good as what it pins. Record the compiler, test runner, and lockfile with each pass, or "green" quietly means something different next week. A flaky test is the worst case: a hard check that behaves like a conversation.
5/5
python-zc-lockfile-4.1-x86_64-1cf.txz: Upgraded.
remmina-1.4.43-x86_64-6cf.txz: Rebuilt.
Enabled RDP support. Thanks to rizitis.
signal-desktop-bin-8.34.0-x86_64-1cf.txz: Upgraded.
veracrypt-1.26.31-x86_64-1cf.txz: Upgraded.
python-zc-lockfile-4.1-x86_64-1cf.txz: Upgraded.
remmina-1.4.43-x86_64-6cf.txz: Rebuilt.
Enabled RDP support. Thanks to rizitis.
signal-desktop-bin-8.34.0-x86_64-1cf.txz: Upgraded.
veracrypt-1.26.31-x86_64-1cf.txz: Upgraded.
November 5, 2026 at 7:01 PM
5/5
python-zc-lockfile-4.1-x86_64-1cf.txz: Upgraded.
remmina-1.4.43-x86_64-6cf.txz: Rebuilt.
Enabled RDP support. Thanks to rizitis.
signal-desktop-bin-8.34.0-x86_64-1cf.txz: Upgraded.
veracrypt-1.26.31-x86_64-1cf.txz: Upgraded.
python-zc-lockfile-4.1-x86_64-1cf.txz: Upgraded.
remmina-1.4.43-x86_64-6cf.txz: Rebuilt.
Enabled RDP support. Thanks to rizitis.
signal-desktop-bin-8.34.0-x86_64-1cf.txz: Upgraded.
veracrypt-1.26.31-x86_64-1cf.txz: Upgraded.
AtomSilo ransomware rides a Confluence exploit and McAfee DLL side-load to hit domain controllers. https://intel.threadlinqs.com/threat/TL-2026-5288?utm_source=bluesky #ThreatIntel #CVE_2021_26084 #Atomsilo #LockFile
November 5, 2026 at 2:41 AM
AtomSilo ransomware rides a Confluence exploit and McAfee DLL side-load to hit domain controllers. https://intel.threadlinqs.com/threat/TL-2026-5288?utm_source=bluesky #ThreatIntel #CVE_2021_26084 #Atomsilo #LockFile
When the source updates, Dependabot opens a pull request to bump your copy and regenerates the lockfile if you have one. No more silently running a stale review prompt for six months.
November 5, 2026 at 3:01 PM
When the source updates, Dependabot opens a pull request to bump your copy and regenerates the lockfile if you have one. No more silently running a stale review prompt for six months.
Store it with the record. Rebuilding from the repo at replay time quietly picks up whatever changed since, which is the drift you were pinning against. Keep the resolved lockfile hash plus runtime and SDK versions on the run, and if a rebuild can't match them, mark the replay unmatched, not failed.
November 4, 2026 at 8:09 PM
Store it with the record. Rebuilding from the repo at replay time quietly picks up whatever changed since, which is the drift you were pinning against. Keep the resolved lockfile hash plus runtime and SDK versions on the run, and if a rebuild can't match them, mark the replay unmatched, not failed.
vercel now blocks known-malicious npm versions before + during install 🛡️
checks the lockfile even from cache. no config. build fails with the bad pkg+version
supply-chain attacks keep winning on install scripts. this is the boring fix that ships
checks the lockfile even from cache. no config. build fails with the bad pkg+version
supply-chain attacks keep winning on install scripts. this is the boring fix that ships
Blocking malicious npm packages before and during installation - Vercel
Vercel now checks for blocked npm package versions before and during installation, helping prevent malicious install scripts from running in new builds.
vercel.com
November 6, 2026 at 11:22 AM
vercel now blocks known-malicious npm versions before + during install 🛡️
checks the lockfile even from cache. no config. build fails with the bad pkg+version
supply-chain attacks keep winning on install scripts. this is the boring fix that ships
checks the lockfile even from cache. no config. build fails with the bad pkg+version
supply-chain attacks keep winning on install scripts. this is the boring fix that ships
Amazon ECSデプロイツール ecspresso v2.8.8をリリースしました
VPC LatticeでのB/G deployに対応しています
github.com/kayac/ecspre...
VPC LatticeでのB/G deployに対応しています
github.com/kayac/ecspre...
Release v2.8.8 · kayac/ecspresso
What's Changed
Document IAM permissions required by --wait-until=deployed by @nishimoto265 in #1102
Skip registry tests on pull rate limit errors by @fujiwara in #1109
Add lockfile for CI and rele...
github.com
November 5, 2026 at 3:05 AM
Amazon ECSデプロイツール ecspresso v2.8.8をリリースしました
VPC LatticeでのB/G deployに対応しています
github.com/kayac/ecspre...
VPC LatticeでのB/G deployに対応しています
github.com/kayac/ecspre...
#後で読む 用メモです→
GitHub ActionsのSHAピン留めを設定で強制する何が止まるかlockfileならタグのまま通せるかを試す
GitHub ActionsのSHAピン留めを設定で強制する何が止まるかlockfileならタグのまま通せるかを試す
GitHub ActionsのSHAピン留めを設定で強制する。何が止まるか、lockfileならタグのまま通せるかを試す | DevelopersIO
GitHub ActionsのSHAピン留めは設定で強制できます。タグ参照のほか、composite actionの中のタグ参照でも止まりました。GAになったworkflow lockfileならタグのまま通ることを確かめ、フルSHAへの書き換えとの使い分けを整理します。
dev.classmethod.jp
November 4, 2026 at 3:54 PM
#後で読む 用メモです→
GitHub ActionsのSHAピン留めを設定で強制する何が止まるかlockfileならタグのまま通せるかを試す
GitHub ActionsのSHAピン留めを設定で強制する何が止まるかlockfileならタグのまま通せるかを試す
Your AI assistant just added a dependency and quietly left the lockfile behind. That tiny gap is how unreviewed versions sneak into your build and all the way to production. ⚓
https://seaworthycode.com/news/your-ai-assistant-forgot-the-lockfile-again
https://seaworthycode.com/news/your-ai-assistant-forgot-the-lockfile-again
November 3, 2026 at 9:00 AM
Your AI assistant just added a dependency and quietly left the lockfile behind. That tiny gap is how unreviewed versions sneak into your build and all the way to production. ⚓
https://seaworthycode.com/news/your-ai-assistant-forgot-the-lockfile-again
https://seaworthycode.com/news/your-ai-assistant-forgot-the-lockfile-again
Supply chain: Python only, no install scripts, hashed lockfile, signed PyPI releases, pip-audit clean. Dependabot waits 7 days on routine upgrades.
uvx agent-wire-cli install --client auto
uvx agent-wire-cli install --client auto
November 4, 2026 at 11:02 AM
Supply chain: Python only, no install scripts, hashed lockfile, signed PyPI releases, pip-audit clean. Dependabot waits 7 days on routine upgrades.
uvx agent-wire-cli install --client auto
uvx agent-wire-cli install --client auto