When I ask for a small bugfix, I add an explicit rule: do not edit package-lock.json, yarn.lock, or pnpm-lock unless the task is dependency work.
State the boundary up front
Paste the error and the files you expect to change. Mention that lockfiles are off limits for this turn.
If Claude Code proposes a version bump, reject and ask for a minimal code change instead.
Review the diff list
Before apply, scan for lockfile paths. One accidental lock refresh can swamp a PR review.
When you really need upgrades, run a separate session titled “dependency bump only”.