A transit GTFS validator must produce the same dependency tree on every CI agent. How do lockfiles differ from floating version ranges for that goal?
Select an answer to reveal the explanation.
Short Explanation
A lockfile is the packing list of exact versions CI already resolved—replay it and you get the same tree. Floating ranges are 'whatever's newest,' which can drift between agents.
Full Explanation
A transit GTFS validator must produce the same dependency tree on every CI agent. Lockfiles and floating version ranges serve different purposes in that goal. Lockfiles record the exact resolved versions (including transitive dependencies) from a successful resolve so subsequent installs replay the same tree. Floating ranges express constraints that resolvers may satisfy with newer compatible versions over time, so two agents or two days can diverge. For reproducible CI, lockfiles are the mechanism that freezes the tree; floating ranges alone do not. Floating ranges do not freeze exact transitive versions better than lockfiles—the opposite is true. Lockfiles are not UI theme stores; they list package versions and integrity metadata for package managers. Floating ranges and lockfiles are not identical formats with different filenames; they encode different reproducibility guarantees. Exam caveat: commit the lockfile, install in CI with the package manager's locked/frozen mode, and only refresh the lockfile intentionally when upgrading the GTFS validator's dependencies under test. Operational check: build on two clean CI agents from the same commit with the lockfile present, diff installed versions, confirm identical trees, then temporarily remove or ignore the lockfile in a sandbox to demonstrate drift under floating ranges before restoring locked installs for production pipelines.