Supply Chain
Lockfile
Also: package-lock.json, bun.lock, poetry.lock
A file that records the exact version, and usually a hash, of every dependency so installs are repeatable.
In more detail
Without a lockfile, a fresh install may pick up a newer, compromised version. With one, the build gets exactly what was reviewed. Commit lockfiles, install from them in CI and review changes to them in pull requests.