---
title: "Version pinning from lockfiles"
description: "How the library docs service reads package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, uv.lock, Cargo.lock and go.sum so answers match the version your project runs."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.overlane.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Version pinning from lockfiles

An agent sends the project's lockfiles once, and every later query with `--project` answers from the pinned version.

```sh
overlane docs pins --project prj_1
```

Without `--lockfile` the command reads the lockfiles in the current directory. The service reads the text with a line-based reader; a lockfile is never run or evaluated.

| Lockfile | Pins |
|---|---|
| `package-lock.json` | direct dependencies named by the root package; every locked package in a v1 file |
| `pnpm-lock.yaml` | the importers' direct dependencies; every package in the file when none are listed |
| `yarn.lock` | every locked package (classic and berry) |
| `requirements.txt` (`pip freeze`) | every `name==version` line |
| `uv.lock`, `Cargo.lock` | every package from a registry source |
| `go.sum` | the highest version of each module |

Re-sending a lockfile replaces the pins of the ecosystems it contains and leaves the others alone.

## The pin decides the answer

When a project pins `acme-widgets` at 1.4.0, a query returns only chunks of version 1.4.0 from a source that documents 1.4.0. The index keeps a separate set of chunks per version, the search is filtered to the pinned one, and a second check drops any chunk whose version differs. If the library's source does not publish the pinned version, the answer is `pin_unavailable` with no snippets and a note, never text from another version. An agent can then index a versioned URL:

```sh
overlane docs index acme-widgets --version 1.9.0 --source-url "https://docs.example.com/{version}/"
```

## What is indexed

`overlane docs deps --project prj_1` lists each pin as `indexed`, `stale`, `private` or `missing`, with the exact command that indexes it. `--index-missing` runs those commands (at most 20 a run).

```js run
const line = "flaskette==3.0.1";
const [name, version] = line.split("==");
assert.equal(name, "flaskette");
assert.equal(version, "3.0.1");
```

Source: https://docs.overlane.app/library-docs/version-pinning/index.mdx