SEV-3: reported, blocks only with --strict

Your deploys are not repeatable

What goes wrong

A dependency updates itself on the next deploy and production breaks with no code change.

Commit your lockfile: package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lockb.

npx sigship

Run it in your project. It reports this check as no-lockfile, along with 16 others. Nothing leaves your machine.