Developer Tools
NuGet lock files and locked mode: repeatable restores in CI
Enable packages.lock.json with RestorePackagesWithLockFile, then use locked mode in CI so a restore either matches the lock or fails loudly.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
npmrc basics: scoped registries and tokens that stay on one host
Route a package scope to a private registry with one npmrc line and scope the auth token to that host so npm never sends it to the wrong place.
Oct 18, 20263 min read
Developer Tools
npm workspaces: install and run commands for one package
How npm workspaces link packages, and the exact commands to add a dependency, run a script or test one package or all of them in a monorepo.
Oct 18, 20263 min read
Developer Tools
npm workspaces explained: one repo, many packages, one install
How npm workspaces link local packages, where the lockfile lives, and how to run commands in one, several or all workspaces without surprises.
Oct 18, 20263 min read
Developer Tools
npm peer dependencies explained: what changed in npm 7 and why
Peer dependencies state which host package a plugin works with. Since npm 7 they install by default. Learn optional peers and how to write a sane range.
Oct 18, 20263 min read
Developer Tools
npm overrides: how to force a version of a transitive dependency
How npm overrides work in package.json: root only scope, nesting, version keys, the dollar reference and the error when you override a direct dependency.
Oct 18, 20263 min read
Developer Tools
npm outdated explained: Current, Wanted and Latest columns
What the Current, Wanted and Latest columns in npm outdated mean, why Wanted can differ from Latest, and what the red and yellow colours tell you.
Oct 18, 20263 min read
Developer Tools
Should you set npm ignore-scripts on your developer machine?
Setting ignore-scripts to true stops install-time scripts from running. It helps on a laptop, breaks some packages and does not cover code that runs later.
Oct 18, 20263 min read
Developer Tools
package.json engines is advisory by default: how to enforce it
The engines field in package.json only warns unless engine-strict is set. Learn what it does, where it matters, and how to pin your runtime in CI.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.