For a team using several languages, the short answers are: lock every deployable repo, install in locked mode in CI, check integrity where the tool supports it, produce an SBOM per build, and give each service an owner. Below are the ten questions that come up most, answered in a few lines each.
1. Do all package managers use lockfiles?
No. npm, Cargo, Composer, NuGet and Gradle each have one, though NuGet and Gradle make you opt in. Go records checksums in go.sum. Python has a standard lock format, pylock.toml, defined by PEP 751. See which lockfile each language uses.
2. Should I commit the lockfile?
For anything you deploy, yes. For a library, the docs differ: Composer says libraries do not need to, and NuGet says a library you do not ship should not.
3. How do I stop CI from changing the lock?
Use the locked install mode of each tool. npm has a clean install command, Cargo a locked flag, NuGet a locked restore mode. The CI guide lists them.
4. Does every tool verify downloads?
No. Go checks module hashes against go.sum by default. pip checks only when you provide hashes. npm can verify registry signatures when you run the command. See integrity checking by language.
5. Can dependencies run code on my machine?
Some can. npm has install lifecycle scripts, and Cargo runs build scripts before building a package. Check each ecosystem you use.
6. How do I get one list of everything I use?
Generate an SBOM from each build in CycloneDX or SPDX and keep them in one place. Both are open standards. See reading one report across languages.
7. Do different audit tools mean the same thing?
No. npm audit matches advisories to your tree. govulncheck reports whether your code calls the vulnerable function. Their counts are not comparable.
8. Who should do the upgrades?
The team that owns the service. A central group sets the baseline and the report. See ownership for polyglot teams.
9. How often should we update?
Pick a cadence you can keep. A short weekly routine with small, targeted updates tends to survive longer than a quarterly big bang. See the weekly routine.
10. What if one language cannot do something on this list?
Write it down as an exception with a compensating control, an owner and an expiry date. Do not leave the gap unrecorded.
A one line summary
Same outcomes in every language, tool specific commands in an appendix, and a shared report on top.
Safeguard can help here: it scans dependencies and generates SBOMs, applies reachability analysis so you can sort findings by what your code can actually call, and enforces policies and gates on pull requests. You can try a free scan on a repository to see what it finds.
Quick check
What is the single most useful first step?
Make CI install in locked mode and fail on drift. It is cheap, and it makes every later control more meaningful.
Do I need an SBOM for every build?
It is a good habit, since it gives you a record of what shipped. Store it with the release.
Sources
- npm ci
- Composer basic usage
- NuGet PackageReference
- Go modules reference
- pip secure installs
- PEP 751
- Cargo build scripts
- npm scripts
- CycloneDX overview
- Go govulncheck tutorial
Last reviewed: 19 October 2026.
