Review a lockfile-only hotfix by reading the diff of resolved packages, not the line count. Confirm only the intended package moved, check the new version and its source, rebuild from clean, and verify the built artifact contains the fixed version. A small diff can still carry many changes.
Why this is not as safe as it looks
A lockfile records the exact versions and integrity hashes that a build installs. Regenerating it to pick up a fix can also move other packages that were allowed to float within their ranges. The diff may look like a few lines in the file, or it may be thousands. Either way the real change is the list of resolved packages, which you must read as a list.
Steps
- Generate a package list before and after. Most package managers can print the resolved tree. Compare the two lists, not the raw file.
- Confirm the vulnerable package moved to the fixed version or higher.
- Look at every other package that changed. For each, ask whether it should have moved.
- If other packages moved, try updating only the target package and keep the rest pinned.
- Check that integrity hashes are present for the new entries and that the registry source is the one you expect.
- Do a clean install from the lockfile and run the full test suite.
- Build the artifact and verify the fixed version is actually inside it, using the SBOM or an image scan.
# example: compare resolved packages before and after (npm)
npm ls --all --parseable > after.txt
git stash -q && npm ci && npm ls --all --parseable > before.txt
diff before.txt after.txt
What to look for
| Finding | Action |
|---|---|
| Only the target package changed | Proceed |
| A sibling package moved a minor version | Read its release notes, test the area |
| A new package appeared | Review it like a new dependency |
| A package changed registry or hash style | Stop and investigate |
| A major version jumped | Not a hotfix; plan it separately |
The artifact check matters most
A lockfile edit proves intent. The built artifact proves result. Some builds use a different resolution than local, or vendor a copy of a dependency, so the file can say fixed while the artifact still carries the old one. Scan what you ship.
Pin the rest during emergencies
During an emergency, avoid unrelated upgrades. If your tool offers a mode to update one package with its minimal set of dependencies, use it. Keep the broader update for a calm day.
Try it yourself
Click through it at your own pace, or open it full screen. Look at the version listed for each component, which is the list you compare before and after.
Safeguard scans lockfiles and built artifacts and can open fix PRs through autonomous remediation if you enable it (off by default). A free scan is at gold.safeguard.sh/scan.
Quick check
Is a three line lockfile diff always low risk?
No. The diff size says little. Compare the resolved package lists to see what really moved.
Does a fixed lockfile prove the build is fixed?
No. Scan the built artifact or its SBOM to confirm the fixed version is inside.
Last reviewed: 19 October 2026.
