A dependency lockfile records selection; integrity and vulnerability checks answer other questions

A package lockfile records the resolved dependency tree. Its integrity fields identify expected artifact content. A vulnerability audit compares dependency information with reports of known problems. These controls address different failure modes.

Illustrative example: a team locks a particular package version and consistently receives the expected bytes. A later advisory can still identify a vulnerability in exactly that version. Reproducibility has succeeded while security maintenance still requires a decision.

Review lockfile changes as selection changes, investigate unexpected source or integrity changes, and evaluate applicable vulnerability reports separately. A passing audit means the tool did not report known matching vulnerabilities under that run's data and configuration; it is not a proof that no vulnerability exists.

Keep the questions explicit: “Which version and source did we select?”, “Did we receive the expected artifact?”, and “What known risks affect this selection?” This makes it harder to mislabel one passing control as a complete supply-chain review.

Limit: installer versions, platforms, optional dependencies, and configuration influence realized installations. The lockfile is important evidence, not a universal guarantee of identical runtime behavior, trusted authorship, or harmless package execution.