Philippines staffing research · Published: September 10, 2026

Studying lockfile drift without treating every diff as a dependency change

Connect resolver versions and metadata churn to installed code.

A large lockfile diff may come from one upgrade, a package-manager change, registry metadata, or full re-resolution. Line count does not show how much installed code changed.

npm documents package-lock semantics and npm ci. Those sources define expected tool behavior, but do not prove two environments received identical bytes.

Methodology: start from one reviewed commit in a clean disposable environment. Record runtime, package manager, configuration, registry, lockfile version, command, requested change, resolved versions, integrity fields, and resulting tree. Repeat without a manifest change.

Scope and inference boundaries: the comparison can attribute observed differences to tested conditions. It cannot establish package safety, immutable registry content, or identical optional dependencies across systems.

Limitations: lifecycle scripts, native builds, mirrors, platform packages, and external services reduce reproducibility. Preserve credential-free logs and report unknowns. The technical owner approves dependencies and releases.