CocoaPods locks versions in Podfile.lock and Carthage in Cartfile.resolved, and both tell you to commit them. Swift Package Manager records resolved versions in its own resolved file, and Gradle offers dependency locking as an option you turn on. In every case, commit the file and review its diffs.
Comparison
| Tool | Rules file | Resolved record | Commit it? |
|---|---|---|---|
| CocoaPods | Podfile | Podfile.lock | Yes, per the CocoaPods guide |
| Carthage | Cartfile | Cartfile.resolved | Yes, per the README |
| SwiftPM | Package.swift | Resolved file generated by the tool | Yes, as a rule of reproducible builds |
| Gradle | Build scripts and catalogs | Lock files if dependency locking is enabled | Yes, once enabled |
The first two rows come from the official guidance. For the others, check the current documentation for exact file names and flags in your tool version.
Rules versus results
Every manager has two layers. The rules file says what you will accept, such as a range. The resolved record says what you actually got. Advisories are written against versions, so the resolved record is the file that answers "am I affected".
Audit questions
- Is the resolved file committed on every branch you ship from?
- Does CI install from it rather than re resolve?
- Who reviews changes to it?
- Can you produce the version of every dependency in last month's release?
- For Gradle, is locking turned on? How to turn it on shows the steps.
- Do you have an inventory that spans all managers if your app mixes them?
Mixed projects
Many apps use more than one. An iOS app may have pods and Swift packages. A Kotlin Multiplatform app adds Gradle on top. Each file covers its own world, so combine them into one list or you will miss a layer.
Try it yourself
Click through it at your own pace, or open it full screen. Check how direct and transitive packages come together in one view.
Safeguard builds an SBOM and scans your dependencies for known vulnerabilities, and you can run a free scan at gold.safeguard.sh/scan to see what your own project pulls in.
Quick check
Which is more useful for an advisory, the rules or the resolved file?
The resolved file. It lists the versions you actually use, while the rules file lists what you would accept.
Is Gradle locked by default?
No. Dependency locking is something you turn on. See the linked how to for the steps.
Sources
- CocoaPods guide: pod install vs pod update
- Carthage README
- Swift Package Manager PackageDescription reference
Last reviewed: 19 October 2026.
