Rush "rush update" / shrinkwrap Out of Date in CI

Rush separates rush install (install exactly what the shrinkwrap pins) from rush update (recompute the shrinkwrap after dependency changes). CI uses rush install and fails if a project’s package.json changed without a matching rush update.

What this error means

rush install fails in CI complaining the shrinkwrap is out of date with a project’s package.json. It happens after someone edits dependencies without running rush update and committing the result.

Rush output

The shrinkwrap file is out of date with package.json for project "@acme/web".
Please run "rush update" and commit the updated shrinkwrap file.

Common causes

Dependencies edited without rush update

Changing a project’s package.json without re-running rush update leaves common/config/rush/*-lock.yaml (the shrinkwrap) stale, which rush install rejects.

Shrinkwrap not committed

If the updated shrinkwrap is not committed, CI installs against the old pinned set and flags the mismatch.

How to fix it

Run rush update and commit the shrinkwrap

Recompute the lock after dependency edits and commit it.

Terminal

rush update
git add common/config/rush && git commit -m "rush update"

Use rush install (frozen) in CI

CI should install exactly what is pinned and fail on drift, not silently update.

.github/workflows/ci.yml

rush install   # installs from the committed shrinkwrap, fails if stale

How to prevent it

Run rush update after any package.json dependency change and commit the shrinkwrap.
Use rush install (not rush update) in CI so drift fails fast.
Add a PR check that rush install succeeds against the committed lock.