Group
  • Security

    Pin my dependencies and commit the lockfile

    Makes builds reproducible with exact versions, a committed lockfile, and no surprise auto-upgrades.

    • Improve quality
    • Plan & validate
    • Beginner
    • Replit
    • Cursor
    • Bolt
    • Lovable
    • General

Free Prompt

Make my dependency setup reproducible and review how versions are specified. Check my package manifest and lockfile situation. Apply: a lockfile exists and is committed (package-lock.json, yarn.lock, pnpm-lock.yaml as appropriate); dependencies use exact versions or conservative ranges in the manifest (avoid * and latest); installs in CI and production use the lockfile-strict command (npm ci or the equivalent) so builds match exactly what was tested; and no dependency is installed from a floating branch, a gist, or a random URL. Review the dependency list itself for packages that are abandoned (years without a release), duplicated (three different date libraries), or unnecessary (a whole framework for one utility function), and propose removals where the win is clear. Do not upgrade everything to the newest version as part of this; reproducibility first, upgrades deliberately. Do not remove anything that's still imported. Deliver: the lockfile status, manifest changes, the strict-install setup for my deploy target, and a short list of dependency hygiene findings (abandoned, duplicated, unnecessary) with your recommendation for each.

What This Does / How This Helps

Makes every build install exactly the same code: exact versions, committed lockfile, and strict installs in production. Reproducibility is a security issue, not just an ops nicety. Floating versions mean a dependency can ship a new release between your last test and your launch deploy, and you run code you never reviewed. That's also how compromised package updates sneak in: the lockfile is what stops a hijacked minor release from auto-installing. You also get a hygiene pass on the dependency list itself, since AI builders install freely and every abandoned package is future attack surface you're maintaining for no benefit.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts