Repository navigation
[FEATURE]: lockfiles (or similar) support for plugins #8935
Description
Feature hasn't been suggested before.
- I have verified this feature I'm about to request hasn't been suggested before.
Describe the enhancement you want to request
(if this has been suggested before, sorry. I did search)
I noticed that some plugins recommend installing them with @latest. I'm aware of the previous npm supply chain issues so I won't be doing that, but I assume a fair amount of people are. It'd be great to have some sort of lockfile support or "Are you sure you want to upgrade?" prompt if someone does use @latest or similar un-pinned versions. Of course, people might just blindly accept those prompts, but I think its worth a little effort here given the potential risks.
Activity
github-actions commentedon Jan 16, 2026
This issue might be a duplicate of existing issues. Please check:
These issues address related concerns about plugin versioning, pinning, and handling of unpinned/@latest versions. Your proposal for lockfile support could complement or address concerns raised in these existing issues.
Feel free to ignore if your specific case requires a different approach.
thdxr commentedon Mar 25, 2026
To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.