alt Hacker News> No one is going around checking every single line change in auto-generated files.
There's a simple fix for your particular case: commit your lock fine (which you should do) and always review the diff (which you should also do). (:
Replies
DanielHB • today at 12:36 PM
I made changes to my dependency lists in the same code where Claude ran npm update. The lockfile diff was a few hundred lines after I undid what Claude did.
And yes, eventually I did check the lockfile changes and spotted the problem. I just usually don't check the lockfile that throughly.
➕ show 1 reply
catlifeonmars • today at 12:27 PM
Heh, I also notice some coding agents like to explicitly git ignore the lockfile.
Forgeties79 • today at 12:21 PM
“But I have an agent for that.”
You've made me realise a good signal for bug hunting: Search repos with lock files listed in their .gitignore.
It's the sort of terrible practice that someone might be frustrated into taking after a nasty merge conflict, and signals a willingness to cut corners.