chore: remove lock files and tighten dependency version ranges

.github/CONTRIBUTING.md

@@ -1,6 +1,6 @@
 # Contributing
 
-Thank you for your interest in contributing to the Response Verification package for the Internet Computer.
+Thank you for your interest in contributing to the ICP CLI templates for the Internet Computer.
 By participating in this project, you agree to abide by our [Code of Conduct](./CODE_OF_CONDUCT.md).
 
 As a member of the community, you are invited and encouraged to contribute by submitting issues, offering suggestions for improvements, adding review comments to existing pull requests, or creating new pull requests to fix issues.
@@ -15,7 +15,7 @@ The contributor guidelines are intended to make the contribution process easy an
 
 Before contributing, consider the following:
 
-- If you want to report an issue, click [issues](https://github.com/dfinity/icp-cli-recipes/issues).
+- If you want to report an issue, click [issues](https://github.com/dfinity/icp-cli-templates/issues).
 - If you have more general questions related to this package and its use, post a message to the [community forum](https://forum.dfinity.org/).
 - If you are reporting a bug, provide as much information about the problem as possible.
 - If you want to contribute directly to this repository, typical fixes might include any of the following:
@@ -40,7 +40,7 @@ This section describes the most common workflow scenarios:
 
 To open a new issue:
 
-1. Click [create a new issue](https://github.com/dfinity/icp-cli-recipes/issues/new).
+1. Click [create a new issue](https://github.com/dfinity/icp-cli-templates/issues/new).
 2. Type a title and description, then click **Submit new issue**.
    - Be as clear and descriptive as possible.
    - For any problem, describe it in detail, including details about the crate, the version of the code you are using, the results you expected, and how the actual results differed from your expectations.
@@ -50,7 +50,7 @@ To open a new issue:
 If you want to submit a pull request to fix an issue or add a feature, here's a summary of what you need to do:
 
 1. Make sure you have a GitHub account, an internet connection, and access to a terminal shell or GitHub Desktop application for running commands.
-2. Navigate to the [repository's homepage](https://github.com/dfinity/icp-cli-recipes) in a web browser.
+2. Navigate to the [repository's homepage](https://github.com/dfinity/icp-cli-templates) in a web browser.
 3. Click **Fork** to create a copy of the repository under your GitHub account or organization name.
 4. Clone the forked repository to your local machine.
 5. Create a new branch for your fix by running a command similar to the following:
@@ -78,6 +78,25 @@ If you want to submit a pull request to fix an issue or add a feature, here's a
 12. Make changes to the pull request, if requested.
 13. Celebrate your success after your pull request is merged!
 
+## Template Guidelines
+
+When adding or modifying templates, please follow these conventions:
+
+### No lock files
+
+Lock files (`package-lock.json`, `Cargo.lock`) must **not** be committed to the repository. They are excluded via the root `.gitignore`.
+
+Templates are starting points, not reproducible builds. When a user scaffolds a new project with `icp new`, they should get the latest compatible dependency versions with the most recent bug fixes and security patches. Stale lock files would pin users to outdated versions and undermine this goal.
+
+### Use tilde (`~`) version ranges for npm dependencies
+
+In `package.json` files, prefer tilde ranges (`~1.2.3`) over caret ranges (`^1.2.3`):
+
+- `~1.2.3` allows only **patch** updates (`>=1.2.3, <1.3.0`)
+- `^1.2.3` allows **minor + patch** updates (`>=1.2.3, <2.0.0`)
+
+Since we don't commit lock files, tilde ranges limit the window for breaking changes from upstream dependencies while still picking up bug fixes and security patches automatically.
+
 ## Development
 
 Refer to the documentation in the [Recipe Authoring Guide](../docs/recipe-authoring.md) for more information on how to develop recipes.

.gitignore

@@ -0,0 +1,2 @@
+Cargo.lock
+package-lock.json

README.md

@@ -23,3 +23,7 @@ icp new <project-name> --subfolder <template-name>
 | [hello-world](./hello-world/) | Full-stack dapp with a frontend and backend canister (Rust or Motoko) |
 | [static-website](./static-website/) | A static website deployed to an asset canister |
 | [proxy](./proxy/) | A pre-built proxy canister that forwards HTTP requests to external URLs |
+
+## Contributing
+
+See the [Contributing Guide](.github/CONTRIBUTING.md) for guidelines on adding or modifying templates.

hello-world/frontend/app/package.json

@@ -11,22 +11,22 @@
     "preview": "vite preview"
   },
   "dependencies": {
-    "@icp-sdk/core": "^5.0.0",
-    "react": "^19.1.1",
-    "react-dom": "^19.1.1"
+    "@icp-sdk/core": "~5.0.0",
+    "react": "~19.1.1",
+    "react-dom": "~19.1.1"
   },
   "devDependencies": {
-    "@eslint/js": "^9.33.0",
-    "@icp-sdk/bindgen": "^0.2.1",
-    "@types/react": "^19.1.10",
-    "@types/react-dom": "^19.1.7",
-    "@vitejs/plugin-react": "^5.0.0",
-    "eslint": "^9.33.0",
-    "eslint-plugin-react-hooks": "^5.2.0",
-    "eslint-plugin-react-refresh": "^0.4.20",
-    "globals": "^16.3.0",
+    "@eslint/js": "~9.33.0",
+    "@icp-sdk/bindgen": "~0.2.1",
+    "@types/react": "~19.1.10",
+    "@types/react-dom": "~19.1.7",
+    "@vitejs/plugin-react": "~5.0.0",
+    "eslint": "~9.33.0",
+    "eslint-plugin-react-hooks": "~5.2.0",
+    "eslint-plugin-react-refresh": "~0.4.20",
+    "globals": "~16.3.0",
     "typescript": "~5.8.3",
-    "typescript-eslint": "^8.39.1",
-    "vite": "^7.1.11"
+    "typescript-eslint": "~8.39.1",
+    "vite": "~7.1.11"
   }
 }