yarn --frozen-lockfile Outdated in CI - Fix Lockfile Out of Sync
yarn install --frozen-lockfile (Yarn Classic) fails if installing would change yarn.lock. In CI that guards reproducibility, so the error means your lockfile does not match package.json.
What this error means
The CI install step fails saying your lockfile needs to be updated but --frozen-lockfile prevented this. Locally yarn install succeeds because it is allowed to write yarn.lock.
error Your lockfile needs to be updated, but yarn was run with
`--frozen-lockfile`.
error Found incompatibilities between package.json and yarn.lock.Diagnose it: reproduce the CI install locally
Install failures are usually environment drift rather than a broken lockfile: a different package-manager major, a different Node version, or a cache that is being restored from a run with different inputs. Reproduce the CI conditions before changing the lockfile, because regenerating it hides the real cause.
# match the runner exactly, then install from a clean slate
node --version && npm --version
rm -rf node_modules
npm ci --foreground-scripts
# if that succeeds locally but fails in CI, the difference is the cache
# or the package-manager version, not your lockfileCommon causes
package.json was changed without updating yarn.lock
A dependency edit landed without re-running yarn, so the committed lockfile no longer matches the manifest.
The lockfile was generated by a different yarn version
A different Yarn produced a lockfile shape CI does not accept as frozen.
How to fix it
Update and commit the lockfile
- Run yarn install locally to regenerate yarn.lock.
- Commit the updated lockfile so CI matches it.
yarn install
git add yarn.lock
git commit -m "Update yarn.lock"Verify the fix survives a cold cache
A green run immediately after a fix often proves nothing, because it restored a cache written before the change. Force a cold install once to confirm the fix is real.
# temporarily bust the cache key to prove the fix on a cold runner
- uses: actions/setup-node@v4
with:
node-version: 22
cache: npm
cache-dependency-path: package-lock.json
# then bump this suffix once, run, and remove it
# key: ${{ runner.os }}-node-${{ hashFiles('package-lock.json') }}-v2How to prevent it
- Commit yarn.lock with every dependency change, pin the Yarn version, and keep --frozen-lockfile in CI so drift is caught before merge.