Lockfile conflicts on Dependabot / Renovate update PRs in CI

By Kaveh Alemi·Latchkey

When several update PRs touch the same lockfile, merging one makes the others conflict, because each was generated against the older base. The bot must rebase and regenerate the lockfile before the PR can merge.

What this error means

Update PRs show "This branch has conflicts that must be resolved" on the lockfile, or CI fails on a lockfile that does not match the manifest after a sibling PR merged.

This branch has conflicts that must be resolved
  Conflicting files: package-lock.json

Common causes

The base branch moved after PR creation

A sibling update PR merged first and changed the lockfile, so the remaining PR's lockfile no longer applies cleanly.

No automatic rebase of open update PRs

Without rebasing, each PR keeps its stale lockfile, guaranteeing conflicts as siblings merge.

How to fix it

Rebase the update PR to regenerate the lockfile

1. For Dependabot, comment @dependabot rebase to refresh the branch.
2. For Renovate, enable rebaseWhen so it rebases when the base changes.
3. Let the bot regenerate the lockfile against the new base.

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "rebaseWhen": "behind-base-branch"
}

Reduce concurrent lockfile PRs with grouping

Group updates so fewer PRs touch the lockfile at once, cutting the number of conflicts to resolve.

How to prevent it

• Enable rebasing so update branches track the base branch.
• Group updates to reduce concurrent lockfile changes.
• Merge or close stale update PRs promptly.

Frequently asked questions

Related guides

References

• GitHub Actions documentation