Bun "--frozen-lockfile" Mismatch in CI

By Kaveh Alemi·Latchkey

CI ran bun install --frozen-lockfile, which forbids changing the lockfile. Bun found that package.json no longer matches bun.lock/bun.lockb, so it fails instead of resolving anew.

What this error means

bun install --frozen-lockfile fails reporting the lockfile would change / is out of sync with package.json. It happens after a dependency edit that was not re-locked, or when the lockfile was never committed.

bun output

error: lockfile had changes, but lockfile is frozen
note: try re-running without --frozen-lockfile, or commit an updated bun.lock

Common causes

Dependencies edited without re-locking

A change to package.json (added/removed/bumped dependency) was committed without regenerating the Bun lockfile, so the two disagree under a frozen install.

Lockfile not committed

If bun.lock/bun.lockb is gitignored or missing, a frozen install cannot reproduce the intended set and fails.

How to fix it

Re-lock locally and commit

Run a normal install to update the lockfile, then commit it.

Terminal

bun install
git add bun.lock package.json && git commit -m "Update bun lockfile"

Keep CI frozen and reproducible

Use the frozen flag in CI so installs are deterministic.

.github/workflows/ci.yml

bun install --frozen-lockfile

How to prevent it

Run bun install and commit the lockfile after editing package.json.
Commit bun.lock/bun.lockb to the repo.
Use --frozen-lockfile in CI to catch drift early.

Frequently asked questions

What causes ""--frozen-lockfile" mismatch"?

A change to package.json (added/removed/bumped dependency) was committed without regenerating the Bun lockfile, so the two disagree under a frozen install.

How do I fix "--frozen-lockfile" mismatch?