apple/pkl · error · PackageLoadError

projectDependenciesOutOfDateInPackage

projectDependenciesOutOfDateInPackage

Error message

projectDependenciesOutOfDateInPackage

What it means

When resolving a package's declared dependencies, a resolved dependency must not be older than the version the package declares: if resolvedDep.getVersion() is less than the declared packageDependency version, Pkl throws projectDependenciesOutOfDateInPackage, since PklProject.deps.json resolves a transitive dependency older than required by the package.

Source

Thrown at pkl-core/src/main/java/org/pkl/core/module/ProjectDependenciesManager.java:206

    return dep;
  }

  public Map<String, Dependency> getResolvedDependenciesForPackage(
      PackageUri packageUri, DependencyMetadata dependencyMetadata) {
    synchronized (lock) {
      if (!packageDependencies.containsKey(packageUri)) {
        var declaredDependencies = dependencyMetadata.getDependencies();
        var resolvedDeps = new HashMap<String, Dependency>(declaredDependencies.size());
        for (var entry : declaredDependencies.entrySet()) {
          var packageDependency = entry.getValue();
          var canonicalPackage =
              CanonicalPackageUri.fromPackageUri(packageDependency.getPackageUri());
          var resolvedDep = getProjectDeps().get(canonicalPackage);
          if (resolvedDep == null) {
            throw new PackageLoadError("unresolvedProjectDependency", packageDependency);
          }
          if (resolvedDep.getVersion().compareTo(packageDependency.getVersion()) < 0) {
            throw new PackageLoadError(
                "projectDependenciesOutOfDateInPackage",
                packageUri.getDisplayName(),
                packageDependency.getPackageUri().getDisplayName(),
                resolvedDep.getPackageUri().getDisplayName());
          }
          resolvedDeps.put(entry.getKey(), resolvedDep);
        }
        packageDependencies.put(packageUri, resolvedDeps);
      }
      return packageDependencies.get(packageUri);
    }
  }

  public DeclaredDependencies getDeclaredDependencies() {
    return declaredDependencies;
  }

  public Dependency getResolvedDependency(PackageUri packageUri) {

View on GitHub (pinned to f3efcbfc9b)

Solutions

1. Run `pkl project resolve` to upgrade PklProject.deps.json to versions satisfying the package's declarations.
2. If an older pin is deliberate, downgrade the consumed package to a version compatible with the resolved transitive versions.
3. Remove manual pins/constraints in PklProject that force the older transitive version, then re-resolve.
4. Check for URI collisions — two packages with the same package URI but conflicting version requirements.

Example fix

# before: package requires dep 2.0.0, lockfile has 1.5.0
# after
$ pkl project resolve
# lockfile now resolves 2.0.0

#!/bin/sh
# before evaluation, ensure the lockfile satisfies package-declared minimum versions
pkl project resolve
git diff --exit-code PklProject.deps.json || { echo 'Lockfile older than package requirements'; exit 1; }

try {
  depsManager.getResolvedDependenciesForPackage(pkgUri);
} catch (PackageLoadError e) {
  if (e.getMessage().contains("newer than what is declared in `PklProject.deps.json`")) {
    throw new BuildException("Transitive dep pinned too old; run 'pkl project resolve'", e);
  }
  throw e;
}

When it happens

Trigger: getResolvedDependenciesForPackage: after finding resolvedDep, resolvedDep.getVersion().compareTo(packageDependency.getVersion()) < 0 for a package's declared dependency — the lockfile pins an older version than the package requires.

Common situations: Upgrading a package (which bumped its own dependency requirements) without re-resolving the project; a lockfile pinning old transitive versions; teams sharing a stale PklProject.deps.json.

Related errors

• projectDependenciesLocalDependencyOutOfSync
• projectDependenciesOutOfDateInProject
• unresolvedProjectDependency
• cannotResolveDependencyWithoutHierarchicalUris
• cannotResolveDependencyNoProject

AI-assisted analysis of apple/pkl@f3efcbfc9b (2026-09-08). Data as JSON: /api/errors/58980e3a57349bf3. Report an issue: GitHub.