What is the role of a lockfile in dependency management?

• A. Lockfiles lock transitive dependencies to specific versions to prevent drift.
• B. Lockfiles loosen dependency versions to allow flexible upgrades.
• C. Lockfiles only record the package name, not versions.
• D. Lockfiles are optional and have no effect on builds.

Answer: (A)

Lockfiles pin the exact versions of dependencies that were resolved for your project, including transitive ones, so installs in different environments end up with the same package set. When the dependency resolver determines a compatible set of versions, the lockfile records those exact choices (and often associated metadata like checksums). This prevents drift over time and across machines, making builds reproducible and predictable. Lockfiles are typically checked into version control so everyone uses the same dependency graph. The other options misrepresent the purpose: loosening versions would cause instability, recording only names would not fix versions, and treating lockfiles as optional would defeat reproducible builds.