Lock files for dependency integrity in Deno - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main purpose of a lock file in Deno?

Why does Deno use a lock file like deno.lock when managing dependencies?

A To ensure the exact versions and hashes of dependencies are used for consistent builds

B To speed up the download of dependencies by caching them locally

C To list all the dependencies that are outdated and need updating

D To automatically update dependencies to their latest versions on each run

💡 Hint

Think about how to keep your project stable and avoid surprises when dependencies change.

A lock file records the exact versions and cryptographic hashes of dependencies. This ensures that every time you run or build your project, you use the same code, preventing unexpected bugs from updated dependencies.

❓ component_behavior

intermediate

What happens if you run a Deno script with a lock file but without the --lock flag?

Given a deno.lock file exists, what will happen if you run deno run script.ts without --lock=deno.lock?

A Deno will automatically use the lock file without needing the flag

B Deno will refuse to run and show an error about missing the --lock flag

C Deno will delete the lock file and create a new one

D Deno will ignore the lock file and fetch dependencies normally, possibly updating them

💡 Hint

Consider if the lock file is automatically enforced or requires explicit use.

Deno requires the --lock flag to enforce the lock file. Without it, Deno fetches dependencies as usual, ignoring the lock file, which can lead to different versions being used.

📝 Syntax

advanced

Which command correctly generates a lock file for a Deno project?

Select the command that creates or updates the deno.lock file based on current dependencies.

A deno install --lock=deno.lock script.ts

B deno run --lock=deno.lock --lock-write script.ts

C deno cache --lock=deno.lock script.ts

D deno run --lock-write script.ts

💡 Hint

Look for the flag that both uses and writes the lock file during execution.

The --lock-write flag tells Deno to write or update the lock file. It must be combined with --lock=deno.lock to specify the file. This command runs the script and updates the lock file accordingly.

🔧 Debug

advanced

Why does this Deno run command fail with a lock file mismatch error?

You run deno run --lock=deno.lock script.ts but get an error about lock file mismatch. What is the most likely cause?

Deno

import { serve } from "https://deno.land/std@0.177.0/http/server.ts";

serve(() => new Response("Hello"));

A The dependencies have changed but the lock file was not updated with --lock-write

B The script has syntax errors unrelated to the lock file

C The lock file is missing from the project directory

D The --lock flag was used without specifying the lock file path

💡 Hint

Think about what happens if dependencies change but the lock file stays the same.

If dependencies or their versions change but the lock file is not updated using --lock-write, Deno detects a mismatch and refuses to run to protect integrity.

❓ state_output

expert

What is the effect on dependency integrity when running Deno with --lock=deno.lock but without --lock-write?

Consider you have a deno.lock file and run deno run --lock=deno.lock script.ts without --lock-write. What happens if a dependency's remote code has changed since the lock file was created?

A Deno silently updates the dependency and overwrites the lock file

B Deno runs the script using the new dependency code ignoring the lock file

C Deno refuses to run and throws an error because the lock file hash does not match the fetched code

D Deno caches the old dependency code and runs without checking the remote source

💡 Hint

Think about how lock files protect against unexpected changes in dependencies.

When using --lock without --lock-write, Deno verifies that the fetched dependencies match the hashes in the lock file. If they differ, Deno refuses to run to prevent using unverified code.

Practice

1. What is the main purpose of a lock file in a Deno project?

easy

A. To list all available Deno commands

B. To speed up the execution of Deno scripts

C. To save exact versions of dependencies for consistent builds

D. To store environment variables securely

Solution

1. Step 1: Understand what a lock file does

   A lock file records the exact versions and hashes of dependencies used in a project to ensure consistency.

2. Step 2: Identify the purpose in Deno context

   In Deno, the lock file prevents unexpected changes by locking dependency versions during installs and runs.

3. Final Answer:

   To save exact versions of dependencies for consistent builds -> Option C

4. Quick Check:

   Lock file = exact dependency versions [OK]

Hint: Lock files keep dependencies stable and consistent [OK]

Common Mistakes:

• Thinking lock files speed up script execution
• Confusing lock files with environment variable storage
• Assuming lock files list commands

2. Which Deno command option is used to create or update a lock file?

easy

A. --unstable

B. --lock

C. --reload

D. --lock-write

Solution

1. Step 1: Identify command options related to lock files

   --lock is used to specify a lock file to use, but does not create or update it.

2. Step 2: Understand which option writes the lock file

   --lock-write tells Deno to create or update the lock file with current dependencies.

3. Final Answer:

   --lock-write -> Option D

4. Quick Check:

   Update lock file = --lock-write [OK]

Hint: Use --lock-write to create or update lock files [OK]

Common Mistakes:

• Using --lock alone to update lock files
• Confusing --reload with lock file creation
• Thinking --unstable manages lock files

3. Given the command deno run --lock=lock.json --unstable app.ts, what will happen if lock.json is missing?

medium

A. Deno will throw an error and refuse to run

B. Deno will create a new lock.json automatically

C. Deno will run the script but ignore dependencies

D. Deno will run the script without checking the lock file

Solution

1. Step 1: Understand the --lock option behavior

   Using --lock requires the specified lock file to exist; otherwise, Deno refuses to run to ensure integrity.

2. Step 2: Check what happens if the lock file is missing

   If lock.json is missing, Deno throws an error and stops execution to prevent unverified dependencies.

3. Final Answer:

   Deno will throw an error and refuse to run -> Option A

4. Quick Check:

   Missing lock file + --lock = error [OK]

Hint: --lock requires existing file; missing file causes error [OK]

Common Mistakes:

• Assuming Deno creates lock file automatically
• Thinking Deno ignores missing lock files
• Confusing --lock with --lock-write behavior

4. You run deno run --lock=lock.json app.ts but get an error about a missing lock file. What is the best way to fix this?

medium

A. Delete the lock.json file and rerun the command

B. Run deno run --lock=lock.json --lock-write app.ts to create the lock file

C. Remove the --lock option from the command

D. Run deno cache app.ts without any lock options

Solution

1. Step 1: Identify cause of error

   The error occurs because the specified lock file does not exist yet.

2. Step 2: Use correct command to create lock file

   Adding --lock-write creates or updates the lock file while running the script.

3. Final Answer:

   Run deno run --lock=lock.json --lock-write app.ts to create the lock file -> Option B

4. Quick Check:

   Create lock file with --lock-write [OK]

Hint: Add --lock-write to create missing lock file [OK]

Common Mistakes:

• Deleting lock file instead of creating it
• Removing --lock option and losing integrity
• Running cache without lock options

5. You want to ensure your team uses the exact same dependencies in production and development. Which practice with lock files is best?

hard

A. Commit the lock file to version control and use --lock on all runs

B. Generate a new lock file on each developer machine separately

C. Ignore the lock file and rely on latest versions always

D. Use --lock-write only in production, not in development

Solution

1. Step 1: Understand team consistency needs

   To keep dependencies consistent, everyone must use the same locked versions.

2. Step 2: Identify best lock file usage practice

   Committing the lock file to version control and using --lock ensures all environments use identical dependencies.

3. Final Answer:

   Commit the lock file to version control and use --lock on all runs -> Option A

4. Quick Check:

   Share lock file + use --lock = consistent deps [OK]

Hint: Commit lock file and use --lock for team consistency [OK]

Common Mistakes:

• Generating separate lock files causing version drift
• Ignoring lock files and risking inconsistent builds
• Using --lock-write only in production causing mismatch