pnpm/pnpm · error

pnpr server rejected the lockfile under the verification pol

Error message

pnpr server rejected the lockfile under the verification policy:
${rendered}

What it means

A pnpr registry can enforce a verification policy over resolved packages (trust, provenance, organizational rules). When resolution succeeds but one or more packages violate the policy, the server returns a `violations` terminal frame listing `name@version` and a reason each; the client renders the list and throws. This is a deliberate policy rejection, not a network or resolver failure — proceeding requires changing the dependencies or the policy.

Source

Thrown at pnpr/client/src/resolveViaPnprServer.ts:199

    preferFrozenLockfile: opts.preferFrozenLockfile,
    // Sent as-is: `opts.lockfile` is already the on-disk format the wire
    // protocol carries (split `packages`/`snapshots`, `{ specifier, version }`
    // importer deps).
    lockfile: opts.lockfile,
  })

  const body = await postResolve(opts.registryUrl, requestBody, opts.authorization)

  const terminal = parseTerminalFrame(body.toString('utf-8'))

  if (terminal.type === 'error') {
    throw new Error(terminal.message)
  }
  if (terminal.type === 'violations') {
    const rendered = terminal.violations
      .map((violation) => `  ${violation.name}@${violation.version}: ${violation.reason}`)
      .join('\n')
    throw new Error(`pnpr server rejected the lockfile under the verification policy:\n${rendered}`)
  }

  return {
    // The server speaks the on-disk lockfile format; convert it to the
    // in-memory `LockfileObject` the rest of pnpm consumes.
    lockfile: convertToLockfileObject(terminal.lockfile),
    stats: terminal.stats,
  }
}

type TerminalFrame = Extract<ResolveFrame, { type: 'done' | 'error' | 'violations' }>

/**
 * Parse the NDJSON `/-/pnpr/v0/resolve` body and return its single terminal
 * frame. `package` frames are skipped — this client fetches tarballs the
 * normal way after resolution rather than overlapping fetch with the
 * stream. Throws on an unknown frame type (so a protocol mismatch fails
 * fast here rather than as a confusing lockfile error downstream) or if

View on GitHub (pinned to 6261b7f388)

Solutions

1. Read the rendered list — each line names the exact package and the reason it was rejected
2. Bump, replace, or pnpm-overrides the offending packages so they satisfy the policy
3. If you operate the server, adjust the verification policy or grant an exception for the listed packages
4. Otherwise ask the package maintainers to publish a compliant version

try {
  await resolveViaPnprServer(opts)
} catch (err) {
  if (err instanceof Error && err.message.includes('rejected the lockfile under the verification policy')) {
    const violations = parseViolationLines(err.message) // name@version: reason
    failFast(`policy violations (${violations.length}):\n${violations.join('\n')}`)
  }
  throw err
}

When it happens

Trigger: Installing dependencies through a pnpr registry configured with a verification policy where at least one resolved package fails verification — untrusted tarball, missing attestation, banned version or license, unapproved scope.

Common situations: Corporate registries enforcing supply-chain rules; a transitive dependency bumps to a version that trips the policy; a newly enabled policy applied to an existing lockfile.

Related errors

• MINIMUM_RELEASE_AGE_DENIED
• terminal.message
• PATCH_FILE_PATH_MISSING
• NODE_SHASUMS_SIGNATURE_INVALID
• AUDIT_NO_LOCKFILE

AI-assisted analysis of pnpm/pnpm@6261b7f388 (2026-08-17). Data as JSON: /api/errors/8b3fcd7e8f4f6d7a. Report an issue: GitHub.