Pin what you depend on directly, keep the lock file enabled, and commit both. Unity's manifest.json lists the packages a project wants, and the lock file records how they were resolved, so every machine and build server gets the same set of versions.
What manifest.json contains
Per the Unity documentation, the project manifest sits in the Packages folder and Package Manager reads it when the project loads. All properties are optional:
| Property | What it does |
|---|---|
| dependencies | Direct requirements, each name mapped to a minimum version; can also point to a local path, tarball or Git URL |
| enableLockFile | Defaults to true; enables a lock file so dependencies resolve deterministically |
| resolutionStrategy | Defaults to lowest; other values are highestPatch, highestMinor and highest |
| scopedRegistries | Custom registries beyond the default |
| testables | Packages whose tests load in the Unity Test Framework |
| pinnedPackages | Packages locked to the exact version in dependencies |
Three settings worth a decision
enableLockFile. Leave it on. Without a lock, two developers can resolve different indirect versions on the same day.
resolutionStrategy. The default of lowest picks the lowest version that satisfies each requirement, which tends to be conservative. The highest options pull newer indirect versions, which may include fixes and may include surprises. Choose on purpose and write down why.
pinnedPackages. Each entry must also be in dependencies, and it locks the exact version listed. Use it for packages where an unreviewed update would be costly, such as networking or payment code.
Watch Git URL dependencies
The documentation says a dependency can point to a Git URL. A Git reference that tracks a branch can change underneath you. If you use one, pin it to a specific commit or tag, and review it like any other code you ship.
A short routine
- Commit
manifest.jsonand the lock file with every dependency change. - Review the diff of the lock file in pull requests, not just the manifest.
- Make build servers use the committed lock, not a fresh resolve.
- Keep a list of which packages you pinned and why.
- Revisit pins on a schedule, so they do not freeze known issues in place.
Try it yourself
Open the demo and compare direct and indirect components. The ones you did not choose are the ones the lock file protects.
Click through it at your own pace, or open it full screen.
Quick check
Does a lock file mean I never get updates?
No. It means updates happen when you choose, as a reviewed change. Pair it with a regular review.
Where is manifest.json?
In the Packages folder of your project, according to the Unity documentation.
Safeguard's SBOM and dependency scanning can read a project's resolved packages and flag known advisories. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
