yarnpkg/yarn · error · MessageError

frozenLockfileError

Error message

frozenLockfileError

What it means

`--frozen-lockfile` forbids lockfile mutation (typical in CI). `install.js:464` throws `frozenLockfileError` ('Your lockfile needs to be updated, but yarn was run with `--frozen-lockfile`.') when the flag is set AND either the lockfile did not parse cleanly (`!lockfileClean`) or the integrity check found missing patterns (`match.missingPatterns.length > 0`). In short: package.json changed in a way the committed yarn.lock no longer satisfies.

Source

Thrown at src/cli/commands/install.js:464

    // We don't want to skip the audit - it could yield important errors
    if (this.flags.audit) {
      return false;
    }
    // PNP is so fast that the integrity check isn't pertinent
    if (this.config.plugnplayEnabled) {
      return false;
    }
    if (this.flags.skipIntegrityCheck || this.flags.force) {
      return false;
    }
    const lockfileCache = this.lockfile.cache;
    if (!lockfileCache) {
      return false;
    }
    const lockfileClean = this.lockfile.parseResultType === 'success';
    const match = await this.integrityChecker.check(patterns, lockfileCache, this.flags, workspaceLayout);
    if (this.flags.frozenLockfile && (!lockfileClean || match.missingPatterns.length > 0)) {
      throw new MessageError(this.reporter.lang('frozenLockfileError'));
    }

    const haveLockfile = await fs.exists(path.join(this.config.lockfileFolder, constants.LOCKFILE_FILENAME));

    const lockfileIntegrityPresent = !this.lockfile.hasEntriesExistWithoutIntegrity();
    const integrityBailout = lockfileIntegrityPresent || !this.config.autoAddIntegrity;

    if (match.integrityMatches && haveLockfile && lockfileClean && integrityBailout) {
      this.reporter.success(this.reporter.lang('upToDate'));
      return true;
    }

    if (match.integrityFileMissing && haveLockfile) {
      // Integrity file missing, force script installations
      this.scripts.setForce(true);
      return false;
    }

View on GitHub (pinned to c2dda503f3)

Solutions

1. Run `yarn install` locally (without `--frozen-lockfile`) to regenerate yarn.lock, then commit it.
2. Ensure the same yarn version is used across team/CI (`yarn policies set-version` or a corepack pin).
3. If the lockfile change is unexpected, diff yarn.lock and reconcile package.json first.

Example fix

// before
$ yarn install --frozen-lockfile
→ Your lockfile needs to be updated, but yarn was run with `--frozen-lockfile`.

// after
$ yarn install            # update yarn.lock locally
$ git add yarn.lock package.json && git commit
$ # CI: yarn install --frozen-lockfile  (now passes)

import fs from 'fs';

function assertLockfileMatchesManifest(pkgJson: { dependencies?: object, devDependencies?: object }, yarnLockText: string): void {
  const allDeps = Object.keys({ ...(pkgJson.dependencies||{}), ...(pkgJson.devDependencies||{}) });
  const missing = allDeps.filter(d => !new RegExp(`^${d.replace(/\//g, '\\/')}@`, 'm').test(yarnLockText));
  if (missing.length) {
    throw new Error(`yarn.lock is missing entries for: ${missing.join(', ')}. Run yarn install (non-frozen) first.`);
  }
}
// assertLockfileMatchesManifest(pkg, fs.readFileSync('yarn.lock','utf8'));

function lockfileParsesClean(parseResultType: string): boolean {
  return parseResultType === 'success';
}

try {
  await yarnInstall({ frozenLockfile: true });
} catch (e) {
  if (/needs to be updated, but yarn was run with `--frozen-lockfile`/.test(e.message)) {
    // non-CI recovery path
    await yarnInstall({ frozenLockfile: false }); // refresh yarn.lock
  } else throw e;
}

When it happens

Trigger: `this.flags.frozenLockfile === true` AND (`lockfile.parseResultType !== 'success'` OR `match.missingPatterns.length > 0`). Most commonly: a dependency was added/updated in package.json but the corresponding yarn.lock change was not committed.

Common situations: A PR adds a dependency and CI runs `yarn install --frozen-lockfile` before the updated yarn.lock is merged; a transitive resolution shifted; a teammate ran `yarn install` with a different yarn version that rewrote the lockfile.

Related errors

• noRequiredLockfile
• Unknown fetcher for $0
• lockfileExists
• installCommandRenamed
• nonInteractiveNoToken

AI-assisted analysis of yarnpkg/yarn@c2dda503f3 (2026-08-13). Data as JSON: /api/errors/69a6816b00cf5296. Report an issue: GitHub.