yarnpkg/yarn · error · MessageError

importSourceFilesCorrupted

Error message

importSourceFilesCorrupted

What it means

`createLogicalDependencyTree` constructs a `LogicalDependencyTree` from the package.json and package-lock.json strings. Any exception from that constructor is caught and rethrown at `import.js:356` as `importSourceFilesCorrupted` ('Failed to import from package-lock.json, source file(s) corrupted'). The original error is swallowed, so the exact parse/structure failure is hidden behind this generic message.

Source

Thrown at src/cli/commands/import.js:356

    activity.end();
    this.activity = null;
  }
}

export class Import extends Install {
  constructor(flags: Object, config: Config, reporter: Reporter, lockfile: Lockfile) {
    super(flags, config, reporter, lockfile);
    this.resolver = new ImportPackageResolver(this.config, this.lockfile);
    this.linker = new PackageLinker(config, this.resolver);
  }
  createLogicalDependencyTree(packageJson: ?string, packageLock: ?string) {
    invariant(packageJson, 'package.json should exist');
    invariant(packageLock, 'package-lock.json should exist');
    invariant(this.resolver instanceof ImportPackageResolver, 'resolver should be an ImportPackageResolver');
    try {
      this.resolver.dependencyTree = new LogicalDependencyTree(packageJson, packageLock);
    } catch (e) {
      throw new MessageError(this.reporter.lang('importSourceFilesCorrupted'));
    }
  }
  async getExternalLockfileContents(): Promise<{packageJson: ?string, packageLock: ?string}> {
    try {
      const [packageJson, packageLock] = await Promise.all([
        fs.readFile(path.join(this.config.cwd, NODE_PACKAGE_JSON)),
        fs.readFile(path.join(this.config.cwd, NPM_LOCK_FILENAME)),
      ]);
      return {packageJson, packageLock};
    } catch (e) {
      return {packageJson: null, packageLock: null};
    }
  }
  async init(): Promise<Array<string>> {
    if (await fs.exists(path.join(this.config.cwd, LOCKFILE_FILENAME))) {
      throw new MessageError(this.reporter.lang('lockfileExists'));
    }
    const {packageJson, packageLock} = await this.getExternalLockfileContents();

View on GitHub (pinned to c2dda503f3)

Solutions

1. Regenerate the lockfile with a compatible npm version (`npm install` using npm 5/6 produces lockfileVersion 1).
2. Resolve git merge-conflict markers in package-lock.json.
3. If on npm 7+, delete package-lock.json and let yarn import fall back to node_modules.

Example fix

// before (npm 7 lockfileVersion: 3)
$ yarn import
→ Failed to import from package-lock.json, source file(s) corrupted

// after
$ rm package-lock.json
$ npm install --use-cli-version=npm6   # or: rely on node_modules import
$ yarn import

import semver from 'semver';

function lockfileVersionSupported(raw: string): boolean {
  let lock: any;
  try { lock = JSON.parse(raw); } catch { return false; }
  // yarn v1 import supports npm lockfileVersion 1
  return typeof lock.lockfileVersion === 'number' && lock.lockfileVersion <= 2 === false ? lock.lockfileVersion === 1 : lock.lockfileVersion === 1;
}

function isNpmLockfileV1(raw: string): boolean {
  try {
    const j = JSON.parse(raw);
    return j && j.lockfileVersion === 1;
  } catch { return false; }
}

try {
  await yarnImport();
} catch (e) {
  if (/source file\(s\) corrupted/.test(e.message)) {
    await fs.unlink('package-lock.json'); // force node_modules fallback
    await yarnImport();
  } else throw e;
}

When it happens

Trigger: `new LogicalDependencyTree(packageJson, packageLock)` throws — e.g. either file fails JSON parse, or the lockfile structure (lockfileVersion, dependencies tree) is not what the parser expects.

Common situations: npm 7+ `package-lock.json` (lockfileVersion 2 or 3) which yarn v1's importer does not understand; a hand-edited or git-merge-corrupted lockfile; truncated file from a failed write.

Related errors

• importResolveFailed
• lockfileExists

AI-assisted analysis of yarnpkg/yarn@c2dda503f3 (2026-08-13). Data as JSON: /api/errors/706d75834379b10a. Report an issue: GitHub.