# dependencies/lockfiles

> Checks that npm, pnpm, Yarn, and text Bun lockfile downloads in each project scope use HTTPS and allowed registry hosts.

Checks that npm, pnpm, Yarn, and text Bun lockfile downloads in each project scope use HTTPS and allowed registry hosts.

Part of the [`dependencies`](/reference/configurations/dependencies/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `commit` [stage](/start/concepts/#stage), once per scope. gspot runs this check itself.

## Why

A lockfile line from another host installs code nobody chose, and reviewers rarely read those files.

## What to do

Install the package from the registry again, or add the host to dependencies.allowed\_registries.

## Example

A lockfile URL outside `dependencies.allowed_registries` reports its host. Install the package again from an allowed registry, or add that host to the list.

## Turn it off

Turn it off for some files, with a reason:

```shell
gspot ignore dependencies/lockfiles --paths "<glob>" --reason "<why>"
```