Cache Hit vs. Stale Dependency Resolution: Balancing Build Speed and Security in Netlify Deployments

Build logs indicate a cache hit even though the package‑lock.json file has not been updated, suggesting that dependency resolution may be using outdated artifacts.

The free tier imposes a 1,000 build minute limit and a 1 GB cache ceiling, so reusing cache can extend build time but may hide security‑relevant dependency changes.

Should cache invalidation be triggered by any change to package‑lock.json, or only by direct dependency updates? Is it safe to rely on cache hits when transitive npm updates occur without a lock file change? How can you confirm that a cache hit does not mask outdated dependencies before deployment?