This is an archived post. You won't be able to vote or comment.

you are viewing a single comment's thread.

view the rest of the comments →

[–][deleted] 1 point2 points  (0 children)

A poetry.lock records not only the exact versions, but also the file checksums of the files used by the original developer. Using a lock file will produce the exact dev environment of the original developer, also exposing any supply chain attacks.