missing-or-ignored-dependency-lockfilelisted

# Missing or Ignored Dependency Lockfile ## Overview Lockfiles (`package-lock.json`, `yarn.lock`, `Pipfile.lock`, `go.sum`, `Gemfile.lock`) pin exact dependency versions. Without them, `npm install` may install newer versions that introduce vulnerabilities or malicious code. Gitignoring lockfiles in application projects is a security anti-pattern. ## Remediation - Commit lockfiles to version control for all application projects - Use `npm ci` instead of `npm install` in CI/CD - Verify lockfile integrity in CI with `--frozen-lockfile`