Lockfile contains every declared dependency

A stale lockfile is a reference-integrity failure at the supply-chain layer (SLSA 1.0 L1): the declared dependency exists in package.json but has no pinned version in the lockfile, so every fresh install can resolve a different version — including one with a known CVE that your pinned version avoided. Beyond security, the presence of two competing lockfiles (package-lock.json + yarn.lock) is a distinct AI confusion signal that indicates the model switched package managers mid-session, leaving the project with contradictory resolution graphs that CI will handle unpredictably.

Delete stale or conflicting lockfiles and regenerate from the correct package manager. If multiple lockfiles coexist, pick one and remove the others before running install.

# npm
rm -rf node_modules package-lock.json && npm install

# yarn
rm -rf node_modules yarn.lock && yarn install

# pnpm
rm -rf node_modules pnpm-lock.yaml && pnpm install

# bun
rm -rf node_modules bun.lockb && bun install

Commit the regenerated lockfile. If package-lock.json and yarn.lock both exist, the project cannot have a deterministic install until one is deleted.