Lockfile Diff

A lockfile diff in a pull request is thousands of unreadable lines. Paste both versions here and get the question everyone actually asks: which packages changed, by how much, and is any of it suspicious.

Runs entirely in your browser. Nothing you paste here is uploaded or stored.

Questions

Is my lockfile uploaded anywhere?

No. Both files are parsed in your browser as pure functions, and the page is served with a Content-Security-Policy of connect-src ‘none’, so it cannot open a network connection at all. That matters here because a lockfile is a map of your dependency surface, and private ones name your internal registry.

Why does a changed integrity hash matter?

Because a published version is supposed to be immutable. If the same version resolves to a different hash than it did before, the artefact behind that fixed version changed — and your build now installs something different while every version number stayed the same. That is worth an explanation before it is merged, and it is exactly the change a line-by-line diff buries.

Which lockfiles are supported?

package-lock.json in all three layouts, pnpm-lock.yaml, and yarn.lock in both the classic v1 format and Berry. The format is detected from the content, so you can paste without saying which is which — and you can compare across package managers, though the result is approximate when you do.

What counts as an alert?

Four things: the same version with a different integrity hash, an integrity hash that was dropped entirely, a version that moved backwards, and a version now resolving from a different host. They are heuristics on the lockfile alone — they tell you a change is the kind worth asking about, not that it is malicious.

It is mostly patch bumps. Can I hide those?

Yes — they are usually the bulk of a lockfile diff and rarely the reason you are looking. Hide them to leave the major, minor and downgraded changes, or switch to alerts only when you are reviewing for supply-chain risk rather than for what upgraded.