Why do lockfiles, pinning, and dependency confusion matter in the build?

A build that pulls dependencies fresh each time is only as trustworthy as whatever the package registry happened to serve that minute. Lockfiles and pinning take that uncertainty out of the build.

Lockfiles: reproducible, verified builds

A lockfile (package-lock.json, yarn.lock, poetry.lock, go.sum) records the exact version of every dependency — direct and transitive — plus an integrity hash of each package's contents. Two consequences matter for security:

• Reproducibility. Every build, on every machine, resolves the identical dependency tree. What you tested is what you ship.
• Tamper detection. Because the lockfile stores content hashes, if a registry serves different bytes for the same version (a compromised package, a MITM), the hash check fails and the build stops. Pinning the version alone isn't enough — the hash is what proves you got the same code.

Dependency confusion

This is the attack that makes scoping essential. If your build resolves package names against both a private registry (for internal packages) and the public one, an attacker can publish a public package with the same name as your internal one but a higher version number. Naive resolution prefers the higher version and pulls the attacker's code into your build. Defenses: scope internal packages to a private registry/namespace, configure resolution so internal names never fall through to public, and verify integrity hashes.

The tension with patching

Pinning everything means you stop getting updates — including security fixes. The answer isn't to stop pinning; it's to pin plus automate controlled updates (e.g. Dependabot/Renovate) that bump versions through review and CI, so you get patches deliberately rather than silently.

What interviewers look for

They want the reproducibility-plus-integrity framing, a correct explanation of dependency confusion and registry scoping, and the maturity to reconcile pinning with staying patched via automated, reviewed updates.