{"record":{"id":"69a6816b00cf5296","repo":"yarnpkg/yarn","slug":"frozenlockfileerror","errorCode":null,"errorMessage":"frozenLockfileError","messagePattern":"frozenLockfileError","errorType":"exception","errorClass":"MessageError","httpStatus":null,"severity":"error","filePath":"src/cli/commands/install.js","lineNumber":464,"sourceCode":"    // We don't want to skip the audit - it could yield important errors\n    if (this.flags.audit) {\n      return false;\n    }\n    // PNP is so fast that the integrity check isn't pertinent\n    if (this.config.plugnplayEnabled) {\n      return false;\n    }\n    if (this.flags.skipIntegrityCheck || this.flags.force) {\n      return false;\n    }\n    const lockfileCache = this.lockfile.cache;\n    if (!lockfileCache) {\n      return false;\n    }\n    const lockfileClean = this.lockfile.parseResultType === 'success';\n    const match = await this.integrityChecker.check(patterns, lockfileCache, this.flags, workspaceLayout);\n    if (this.flags.frozenLockfile && (!lockfileClean || match.missingPatterns.length > 0)) {\n      throw new MessageError(this.reporter.lang('frozenLockfileError'));\n    }\n\n    const haveLockfile = await fs.exists(path.join(this.config.lockfileFolder, constants.LOCKFILE_FILENAME));\n\n    const lockfileIntegrityPresent = !this.lockfile.hasEntriesExistWithoutIntegrity();\n    const integrityBailout = lockfileIntegrityPresent || !this.config.autoAddIntegrity;\n\n    if (match.integrityMatches && haveLockfile && lockfileClean && integrityBailout) {\n      this.reporter.success(this.reporter.lang('upToDate'));\n      return true;\n    }\n\n    if (match.integrityFileMissing && haveLockfile) {\n      // Integrity file missing, force script installations\n      this.scripts.setForce(true);\n      return false;\n    }\n","sourceCodeStart":446,"sourceCodeEnd":482,"githubUrl":"https://github.com/yarnpkg/yarn/blob/c2dda503f3759b5be5f0e24ecd9cf5c97a540147/src/cli/commands/install.js#L446-L482","documentation":"`--frozen-lockfile` forbids lockfile mutation (typical in CI). `install.js:464` throws `frozenLockfileError` ('Your lockfile needs to be updated, but yarn was run with `--frozen-lockfile`.') when the flag is set AND either the lockfile did not parse cleanly (`!lockfileClean`) or the integrity check found missing patterns (`match.missingPatterns.length > 0`). In short: package.json changed in a way the committed yarn.lock no longer satisfies.","triggerScenarios":"`this.flags.frozenLockfile === true` AND (`lockfile.parseResultType !== 'success'` OR `match.missingPatterns.length > 0`). Most commonly: a dependency was added/updated in package.json but the corresponding yarn.lock change was not committed.","commonSituations":"A PR adds a dependency and CI runs `yarn install --frozen-lockfile` before the updated yarn.lock is merged; a transitive resolution shifted; a teammate ran `yarn install` with a different yarn version that rewrote the lockfile.","solutions":["Run `yarn install` locally (without `--frozen-lockfile`) to regenerate yarn.lock, then commit it.","Ensure the same yarn version is used across team/CI (`yarn policies set-version` or a corepack pin).","If the lockfile change is unexpected, diff yarn.lock and reconcile package.json first."],"exampleFix":"// before\n$ yarn install --frozen-lockfile\n→ Your lockfile needs to be updated, but yarn was run with `--frozen-lockfile`.\n\n// after\n$ yarn install            # update yarn.lock locally\n$ git add yarn.lock package.json && git commit\n$ # CI: yarn install --frozen-lockfile  (now passes)","handlingStrategy":"validation","validationCode":"import fs from 'fs';\n\nfunction assertLockfileMatchesManifest(pkgJson: { dependencies?: object, devDependencies?: object }, yarnLockText: string): void {\n  const allDeps = Object.keys({ ...(pkgJson.dependencies||{}), ...(pkgJson.devDependencies||{}) });\n  const missing = allDeps.filter(d => !new RegExp(`^${d.replace(/\\//g, '\\\\/')}@`, 'm').test(yarnLockText));\n  if (missing.length) {\n    throw new Error(`yarn.lock is missing entries for: ${missing.join(', ')}. Run yarn install (non-frozen) first.`);\n  }\n}\n// assertLockfileMatchesManifest(pkg, fs.readFileSync('yarn.lock','utf8'));","typeGuard":"function lockfileParsesClean(parseResultType: string): boolean {\n  return parseResultType === 'success';\n}","tryCatchPattern":"try {\n  await yarnInstall({ frozenLockfile: true });\n} catch (e) {\n  if (/needs to be updated, but yarn was run with `--frozen-lockfile`/.test(e.message)) {\n    // non-CI recovery path\n    await yarnInstall({ frozenLockfile: false }); // refresh yarn.lock\n  } else throw e;\n}","preventionTips":["Always commit yarn.lock together with package.json dependency changes.","Pin a single yarn version across the team and CI (corepack / `yarn policies`).","Run `yarn install --frozen-lockfile` in a pre-merge check so lockfile drift fails the PR, not main."],"tags":["install","lockfile","ci","frozen-lockfile"],"backgroundTag":null,"analyzedSha":"c2dda503f3759b5be5f0e24ecd9cf5c97a540147","analyzedAt":"2026-08-13T04:17:06.305Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}