---
title: "💭 We shouldn’t have needed lockfiles @ tonsky.me"
description: "!https://tonsky.me/blog/lockfiles/"
date: 2025-08-06
published: true
tags:
  - dev
  - thought
template: link
---


<div class="embed-card embed-card-external">
  <a href="https://tonsky.me/blog/lockfiles/" class="embed-card-link" target="_blank" rel="noopener noreferrer">
    <div class="embed-card-image">
      <img src="https://dynogee.com/gen?id=24m2qx9uethuw6p&amp;title=We+shouldn%E2%80%99t+have+needed+lockfiles" alt="We shouldn’t have needed lockfiles — Lockfiles are an absolutely unnecessary concept that complicates things without a good reason. Dependency managers can and are working without it just the same." loading="lazy">
    </div>
    <div class="embed-card-content">
      <div class="embed-card-title">We shouldn’t have needed lockfiles</div>
      <div class="embed-card-description">Lockfiles are an absolutely unnecessary concept that complicates things without a good reason. Dependency managers can and are working without it just the same.</div>
      <div class="embed-card-meta">tonsky.me &middot; tonsky.me</div>
    </div>
  </a>
</div>


I wholeheartedly agree that packaging is broken, semver is broken, expecting much better from a system of oss that is built on top of volunteers, passion projects, nights and weekends is a fools errand.  With that I disagree that we we dont need lockfiles.  Maybe its Nikki's experience in java and my lack that puts us on this opposite spectrum, but without lockfiles the world changes underneath us as we release.  One small change to your source can introduce a whole set of new features/bugs that you did not plan on without a good locking system.  It can also cause you to need to do dependency resolution at application build time and not ahead of time.

!!! note

    This post is a <a href="/thoughts/" class="wikilink" data-title="Thoughts" data-description="These are generally my thoughts on a web page or some sort of url, except a rare few don&#39;t have a link. These are dual published off of my..." data-date="2024-04-01">thought</a>. It's a short note that I make
    about someone else's content online <a href="/tags/thoughts/" class="hashtag-tag" data-tag="thoughts" data-count=2 data-reading-time=3 data-reading-time-text="3 minutes">#thoughts</a>