Constant MAX_LOCKFILE_BYTES 

pub const MAX_LOCKFILE_BYTES: u64 = _; // 33_554_432u64

Maximum lock file size read_lockfile_content reads before parsing.

Deliberately a separate, larger constant than crate::mtime_cache::MAX_CACHED_FILE_BYTES — that cap is scoped to small config files (.cargo/config.toml, .npmrc, typically a few KB), while a lock file records every transitively resolved package across an entire dependency graph, and a large npm monorepo package-lock.json can legitimately run well past 8 MiB. 32 MiB matches crate::cache’s MAX_RESPONSE_BYTES order of magnitude — generous for any realistic lock file while still bounding the read against a maliciously large one discovered by an unauthenticated ancestor walk over a cloned repository (CWE-400).