A lock file records the exact versions of a project’s dependencies, rather than only the allowed version ranges. Examples include files such as package-lock.json, yarn.lock, or poetry.lock. By pinning resolved versions, it makes builds reproducible: the same source code should install the same dependency set today, tomorrow, and on another machine.
In cyber security, lock files matter because dependency drift can hide risk. They help defenders review changes, compare builds, and detect when a package update introduces unexpected behavior. In attacks, adversaries often try to exploit fast-moving dependency updates or supply-chain confusion; a lock file can slow that down by keeping known-good versions in place until a change is reviewed. It is not a complete defense, but paired with code review, provenance checks, and timely updates, it is a core control for safer software supply chains.