PDM "Lock file does not match pyproject.toml" / Install Errors in CI

PDM checks that pdm.lock matches the content hash of pyproject.toml. When dependencies changed without re-locking - or the lock is missing - pdm install/pdm sync refuses to proceed in a CI (frozen) context.

What this error means

pdm install or pdm sync fails complaining the lock file does not match pyproject.toml (or that no lock exists). It happens after someone edits dependencies without running pdm lock, or when the lock was never committed.

pdm output

WARNING: Lock file hash doesn't match pyproject.toml, packages may be outdated.
pdm.lock does not exist or is not up to date. Run `pdm lock` to fix it.

Common causes

Dependencies edited without re-locking

A change to [project] dependencies (or an optional group) in pyproject.toml was committed without regenerating pdm.lock, so the content hashes disagree.

Lock missing or not committed

If pdm.lock is gitignored or never generated, CI has nothing to reproduce from and reports the mismatch.

How to fix it

Regenerate and commit the lock

Re-lock after editing dependencies, then commit the result.

Terminal

pdm lock
git add pdm.lock && git commit -m "Update pdm.lock"

Use a frozen, reproducible install in CI

Install strictly from the committed lock so CI fails loudly on drift rather than silently re-resolving.

.github/workflows/ci.yml

pdm install --check --frozen-lockfile

How to prevent it

Run pdm lock after every pyproject.toml dependency change.
Commit pdm.lock to the repo.
Use pdm install --check in CI to catch lock drift in PRs.