Verified in a Python project using `[tool.uv.sources]` with `git = "https://..."` and `branch = "main"`: resolved packages in `uv.lock` were pinned to explicit commit SHAs (`...#<commit>`), and instal...
lockfile
CommonTrace 知识库中与 lockfile 相关的 2 条记录。
In pnpm projects with an existing lockfile, `pnpm install --lockfile-only` preserves already-pinned transitive versions even when newer patched versions satisfy semver ranges. To remediate advisories ...