Rules / GL023

GL023 Lockfile not enforced in CI install command

Severity: warn
OWASP: CICD-SEC-3 – Dependency Chain Abuse

What glsec checks

glsec flags package manager install commands that do not enforce the committed lockfile. Even when a lockfile (package-lock.json, yarn.lock, Gemfile.lock, etc.) exists, using the wrong command allows the package manager to silently resolve to different versions — either because version ranges in the manifest allow newer versions, or because the lockfile is out of sync with the manifest.

This is distinct from GL022 (installing without any version pin): GL023 assumes a lockfile exists but flags the command that ignores it.

Detected patterns

Package manager	Non-strict (flagged)	Strict alternative
npm	`npm install`	`npm ci`
Yarn	`yarn install`	`yarn install --frozen-lockfile`
Yarn Berry	`yarn install`	`yarn install --immutable`
pnpm	`pnpm install`	`pnpm install --frozen-lockfile`
Bundler	`bundle install`	`bundle install --frozen` or `--deployment`

Trigger examples

build:
  script:
    - npm install              # can update package-lock.json
    - yarn install             # resolves without lockfile enforcement
    - pnpm install             # same
    - bundle install           # same
    - npm install --production # flags are allowed but strictness still missing

Safe alternatives

build:
  script:
    - npm ci
    - yarn install --frozen-lockfile
    - pnpm install --frozen-lockfile
    - bundle install --frozen

Why `npm install` vs `npm ci` matters

npm install:

Updates package-lock.json if it is out of sync with package.json
Installs the latest version permitted by version ranges
Does NOT fail if the lockfile is missing

npm ci:

Fails immediately if package-lock.json is missing or out of sync
Always installs exactly what is in the lockfile
Removes node_modules before installing (clean state)

Notes

npm install <package-name> (installing a specific package) is not flagged by this rule — that is GL022's concern.
npm install -g <package> (global install) is GL022's concern.
composer install (PHP) is the correct lockfile-respecting command and is not flagged. composer update is flagged by GL022.

Documentation for glsec 1.23.0. Source of this page · Rule implementation