{"record":{"id":"58980e3a57349bf3","repo":"apple/pkl","slug":"projectdependenciesoutofdateinpackage","errorCode":"projectDependenciesOutOfDateInPackage","errorMessage":"projectDependenciesOutOfDateInPackage","messagePattern":"projectDependenciesOutOfDateInPackage","errorType":"error_code","errorClass":"PackageLoadError","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/module/ProjectDependenciesManager.java","lineNumber":206,"sourceCode":"    return dep;\n  }\n\n  public Map<String, Dependency> getResolvedDependenciesForPackage(\n      PackageUri packageUri, DependencyMetadata dependencyMetadata) {\n    synchronized (lock) {\n      if (!packageDependencies.containsKey(packageUri)) {\n        var declaredDependencies = dependencyMetadata.getDependencies();\n        var resolvedDeps = new HashMap<String, Dependency>(declaredDependencies.size());\n        for (var entry : declaredDependencies.entrySet()) {\n          var packageDependency = entry.getValue();\n          var canonicalPackage =\n              CanonicalPackageUri.fromPackageUri(packageDependency.getPackageUri());\n          var resolvedDep = getProjectDeps().get(canonicalPackage);\n          if (resolvedDep == null) {\n            throw new PackageLoadError(\"unresolvedProjectDependency\", packageDependency);\n          }\n          if (resolvedDep.getVersion().compareTo(packageDependency.getVersion()) < 0) {\n            throw new PackageLoadError(\n                \"projectDependenciesOutOfDateInPackage\",\n                packageUri.getDisplayName(),\n                packageDependency.getPackageUri().getDisplayName(),\n                resolvedDep.getPackageUri().getDisplayName());\n          }\n          resolvedDeps.put(entry.getKey(), resolvedDep);\n        }\n        packageDependencies.put(packageUri, resolvedDeps);\n      }\n      return packageDependencies.get(packageUri);\n    }\n  }\n\n  public DeclaredDependencies getDeclaredDependencies() {\n    return declaredDependencies;\n  }\n\n  public Dependency getResolvedDependency(PackageUri packageUri) {","sourceCodeStart":188,"sourceCodeEnd":224,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/module/ProjectDependenciesManager.java#L188-L224","documentation":"When resolving a package's declared dependencies, a resolved dependency must not be older than the version the package declares: if resolvedDep.getVersion() is less than the declared packageDependency version, Pkl throws projectDependenciesOutOfDateInPackage, since PklProject.deps.json resolves a transitive dependency older than required by the package.","triggerScenarios":"getResolvedDependenciesForPackage: after finding resolvedDep, resolvedDep.getVersion().compareTo(packageDependency.getVersion()) < 0 for a package's declared dependency — the lockfile pins an older version than the package requires.","commonSituations":"Upgrading a package (which bumped its own dependency requirements) without re-resolving the project; a lockfile pinning old transitive versions; teams sharing a stale PklProject.deps.json.","solutions":["Run `pkl project resolve` to upgrade PklProject.deps.json to versions satisfying the package's declarations.","If an older pin is deliberate, downgrade the consumed package to a version compatible with the resolved transitive versions.","Remove manual pins/constraints in PklProject that force the older transitive version, then re-resolve.","Check for URI collisions — two packages with the same package URI but conflicting version requirements."],"exampleFix":"# before: package requires dep 2.0.0, lockfile has 1.5.0\n# after\n$ pkl project resolve\n# lockfile now resolves 2.0.0","handlingStrategy":"validation","validationCode":"#!/bin/sh\n# before evaluation, ensure the lockfile satisfies package-declared minimum versions\npkl project resolve\ngit diff --exit-code PklProject.deps.json || { echo 'Lockfile older than package requirements'; exit 1; }","typeGuard":null,"tryCatchPattern":"try {\n  depsManager.getResolvedDependenciesForPackage(pkgUri);\n} catch (PackageLoadError e) {\n  if (e.getMessage().contains(\"newer than what is declared in `PklProject.deps.json`\")) {\n    throw new BuildException(\"Transitive dep pinned too old; run 'pkl project resolve'\", e);\n  }\n  throw e;\n}","preventionTips":["Re-resolve after every package upgrade; never assume old transitive pins still satisfy.","Avoid manually pinning transitive dependencies to old versions in PklProject.deps.json.","Check package release notes for bumped dependency requirements before upgrading.","Use CI to enforce lockfile freshness (resolve then diff)."],"tags":["pkl","dependencies","version-mismatch","transitive-dependency"],"backgroundTag":"dependency-version-mismatch","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}