Yes, commit Cartfile.resolved. The Carthage README says to, because it lists the versions actually built for each framework, and teammates need it to build the same ones. Without it, each machine may resolve different versions from the loose rules in Cartfile.
The two files
| File | You write it | What it holds |
|---|---|---|
Cartfile | Yes | The frameworks you want and version rules |
Cartfile.resolved | No, generated | The versions that were actually built |
The README describes the first as the list of frameworks you would like to use, placed next to your Xcode project or workspace. The second is created during the build and records what was built.
Why the resolved file matters for security
A dependency list that changes between machines cannot be audited. Committing Cartfile.resolved gives you a record you can review in a pull request. You can see when a version moved, who approved it, and which build used it.
It also supports vulnerability work. When an advisory names a version range, the resolved file tells you whether you are inside it. The Cartfile alone cannot, because it holds rules, not results.
Using it well
- Commit
Cartfile.resolvedwith every change toCartfile. - Treat a diff in it like a diff in code. Ask why each version moved.
- Update on purpose, not as a side effect of onboarding a new developer.
- Keep a dated copy for each release you ship.
- When an advisory lands, compare the affected range with the resolved versions first.
- If you are retiring Carthage, record the resolved file before you migrate. Migrating without losing visibility uses the same baseline idea for CocoaPods.
What this file does not tell you
It does not prove the code is safe, and it does not say whether the framework is still maintained. The README also does not state a maintenance status, so check the project activity yourself before you depend on it for new work.
Try it yourself
Click through it at your own pace, or open it full screen. See how a list of findings maps back to specific versions in use.
Safeguard builds an SBOM and scans your dependencies for known vulnerabilities, and you can run a free scan at gold.safeguard.sh/scan to see what your own project pulls in.
Quick check
What happens if I do not commit Cartfile.resolved?
Other developers and CI may build different framework versions than you did, and you lose the record of what shipped.
Can I edit Cartfile.resolved by hand?
It is generated during the build. Change the Cartfile and rebuild instead, then review the resulting diff.
Sources
Last reviewed: 19 October 2026.
