Deno "lockfile integrity mismatch" in CI

By Daniel Zoghalchali·Latchkey

Deno verified a fetched module against deno.lock and the hash did not match. Either a dependency changed without re-locking, or --frozen is set and the imports drifted from the committed lockfile.

What this error means

A run or deno cache fails with "lockfile integrity check failed" or, under --frozen, "lock file out of date". It happens after imports change without the lockfile being regenerated and committed.

deno output

error: The lockfile is out of date. Run `deno cache` or use the `--lock-write`
flag to update it.
# or
error: Integrity check failed for https://deno.land/std@0.224.0/mod.ts

Common causes

Imports changed without re-locking

A new or updated import was added but deno.lock was not regenerated, so the recorded hashes no longer match what Deno fetched.

--frozen lockfile in CI with drift

CI runs with a frozen lockfile to guarantee reproducibility. If the committed deno.lock is stale, the frozen check fails instead of silently updating.

How to fix it

Regenerate and commit the lockfile

Update deno.lock locally so it matches your imports, then commit it.

Terminal

deno cache --lock=deno.lock --lock-write main.ts
git add deno.lock && git commit -m "Update deno.lock"

Keep the frozen check in CI

Frozen lockfiles are correct for CI - fix the drift rather than disabling the check.

.github/workflows/ci.yml

deno cache --frozen main.ts

How to prevent it

Commit deno.lock and regenerate it whenever imports change.
Run deno cache --frozen in CI to catch drift in PRs.
Pin remote module versions so hashes stay stable.

Frequently asked questions

What causes ""lockfile integrity mismatch""?

A new or updated import was added but deno.lock was not regenerated, so the recorded hashes no longer match what Deno fetched.

How do I fix "lockfile integrity mismatch"?

Update deno.lock locally so it matches your imports, then commit it.

References

GitHub Actions documentation