pnpm "ERR_PNPM_OUTDATED_LOCKFILE" with --frozen-lockfile in CI

By Kaveh Alemi·Latchkey

CI runs pnpm install --frozen-lockfile, which forbids changing pnpm-lock.yaml. pnpm found the lockfile out of sync with one or more package.json files and refuses to proceed, so the stale lockfile must be regenerated and committed.

What this error means

A pnpm install --frozen-lockfile (or pnpm i in CI) step fails with "ERR_PNPM_OUTDATED_LOCKFILE Cannot install with \"frozen-lockfile\" because pnpm-lock.yaml is not up to date with <manifest>".

ERR_PNPM_OUTDATED_LOCKFILE  Cannot install with "frozen-lockfile" because
pnpm-lock.yaml is not up to date with packages/api/package.json

Common causes

A package.json changed without relocking

A dependency was added or bumped in a manifest, but pnpm-lock.yaml was not regenerated and committed alongside it.

A different pnpm version produced a different lockfile shape

The lockfile format or resolution differs between the local pnpm and the CI pnpm, so the committed lockfile looks outdated.

How to fix it

Regenerate and commit the lockfile

1. Run pnpm install locally (without frozen) to update pnpm-lock.yaml.
2. Commit the updated lockfile with the manifest change.
3. Re-run CI so the frozen install matches.

pnpm install
git add pnpm-lock.yaml

Pin pnpm so versions match

Use the same pnpm version locally and in CI via packageManager so lockfile shape is consistent.

{
  "packageManager": "pnpm@9.7.0"
}

How to prevent it

• Commit pnpm-lock.yaml with every manifest change.
• Pin pnpm with the packageManager field so CI matches local.
• Keep --frozen-lockfile in CI to catch drift early.

Frequently asked questions

Related guides

References

• GitHub Actions documentation