A lockfile maintenance pull request refreshes the resolved versions recorded in your lockfile, including transitive packages, without changing the ranges in your manifest. Merge it like a batch of small updates: read the diff summary, run tests, and keep it away from release freezes.
Why the lockfile drifts
Your manifest says a range, such as any compatible newer version. The lockfile records the exact versions chosen on the day it was last updated. Over months, newer releases appear inside your ranges, but nothing moves until someone refreshes the file. Transitive dependencies, the packages your packages need, are the usual victims. Your direct update bot may never touch them because they are not named in your manifest.
What the pull request contains
Typically a large lockfile diff and no manifest change. Many versions move at once, mostly patch and minor changes inside ranges you already accepted. That makes it both valuable and awkward to review.
Is it safe
It is as safe as the ranges you wrote. If your ranges accept any newer minor, the refresh can pull in a minor you never tested. For packages at 0.x, the Semantic Versioning specification allows anything to change at any time, so a refresh inside a loose 0.x range can still break you.
Review steps
- Check that the manifest is unchanged. If it changed, it is not a pure maintenance pull request.
- Skim the list of changed packages. Look for anything unfamiliar or newly added to the tree.
- Run the full test suite and your smoke tests.
- Check any new or removed transitive packages. A new name in the tree deserves a look at who publishes it.
- Merge on a normal day, not on a Friday or a freeze.
- Rebuild from the lockfile in CI to confirm that a clean install works.
When to schedule it
| Cadence | Fits |
|---|---|
| Weekly | Active services with good tests |
| Monthly | Most teams |
| Quarterly | Stable, rarely changed projects |
| Never | Gaps build up and later jumps get larger |
Why it also helps security
A refresh is often how a fixed transitive version reaches you, since direct bumps cannot reach it. Waiting for a direct dependency to release a new version that updates its own requirements can take a long time.
Do not confuse it with pinning
Maintenance moves versions forward within ranges. Pinning fixes them in place. They address different goals, and you can use both with care.
Try it yourself
Click through it at your own pace, or open it full screen. Find a transitive dependency in the tree. These are the packages a lockfile refresh can move without any manifest change.
Quick check
Does a lockfile refresh change my manifest?
A pure maintenance change should not. If the manifest changes too, review it as a normal update.
How often should we do it?
Monthly suits most teams, weekly for active services with good tests.
Safeguard scans manifests and lockfiles into an SBOM, uses reachability analysis to show which flagged dependencies your code actually calls, and can open fix pull requests (off by default, every category on Manual). You can try a free scan on a public repository.
Sources
Last reviewed: 19 October 2026.
