All 15 Assemblies & NuGet questions
More in Assemblies & NuGet
How does NuGet resolve version conflicts when two packages depend on different versions of the same transitive dependency? What is strong naming of assemblies, and why is it much less commonly required in modern .NET? How do you create and publish your own NuGet package from a class library project? What is the difference between a NuGet package's dependency group targeting different frameworks, and why do multi-targeted packages need this? What are NuGet package sources, and how do you configure a project to pull packages from a private/internal feed alongside NuGet.org? What is Central Package Management (CPM) in NuGet, and how does Directory.Packages.props centralize version control? How does semantic versioning apply to NuGet packages, and what do version range operators like [1.0,2.0) mean? What is assembly loading context, and how does AssemblyLoadContext enable plugin isolation in modern .NET? How do you audit a .NET project's dependencies for known security vulnerabilities using NuGet tooling? How does reflection allow inspecting an assembly's types and metadata at runtime, and what are common uses?
Advertisement
Back to results for “Deployment”
.NET › Assemblies & NuGet

What is a NuGet lock file (packages.lock.json), and what problem does it solve for reproducible builds?

Intermediate

Answer

A lock file records the exact resolved version of every direct and transitive dependency at restore time, ensuring that subsequent restores (across different machines, CI runs, or dates) produce bit-for-bit identical dependency trees rather than potentially resolving to newer compatible versions that happen to be available -- critical for reproducible builds and catching unexpected dependency changes in code review.
<PropertyGroup>
  <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
</PropertyGroup>

# Generates packages.lock.json, committed to source control
# dotnet restore --locked-mode  fails the build if resolution would differ from the lock file
Real-world example A CI pipeline runs `dotnet restore --locked-mode` to guarantee that a build today resolves the exact same dependency versions as it did when the lock file was last committed, catching any unexpected drift immediately.

Common follow-ups: How do you update the lock file when you intentionally want a new version?;How does this compare to npm's package-lock.json conceptually?

CI/CD Publishing & Deployment;.NET CLI SDK & Project Structure (csproj)
All 15 Assemblies & NuGet questions