- Home
- The 17 checks
- Your deploys are not repeatable
🧰 Launch hygiene · Nice to fix (SEV-3)
Your deploys are not repeatable
In plain English: A lockfile records the exact version of every package your app uses. Without one, each deploy can quietly install newer versions, and your live app can break with no change from you.
What happens if you ship it
A dependency updates itself on the next deploy and production breaks with no code change.
How to fix it technical
Commit your lockfile: package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lockb.
Let your AI tool fix it
Paste this into Lovable, Bolt, Cursor, Replit or Claude Code:
Prompt for your AI tool
Fix this problem in my project: Your deploys are not repeatable. Commit your lockfile: package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lockb. Change only what this fix needs, then tell me what you changed and anything I have to do myself.Check your app
Run npx sigship in your project folder. It reports this problem as no-lockfile, along with 16 other checks. Nothing leaves your computer. New to the terminal?
Questions
What is package-lock.json?
The lockfile npm creates. It pins every package to an exact version so every install, on any computer or server, gets the same code.
Should I commit the lockfile?
Yes. Commit package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lockb, whichever your project uses.