pnpm error ERR_PNPM_OUTDATED_LOCKFILE after node version switch

Not specified by the original author.

pnpm error ERRPNPMOUTDATED_LOCKFILE after node version switch

TL;DR: Your lockfile was written by a different pnpm major version than the one now installed. Either switch back to the pinned pnpm via corepack, or regenerate the lockfile with pnpm install. The error is pnpm refusing to trust a lockfile format it does not understand - not a broken project.

pnpm error ERR_PNPM_OUTDATED_LOCKFILE after node version switch

Steps

1. Confirm the mismatch. Run pnpm --version and check the lockfileVersion line at the top of pnpm-lock.yaml. Expected: the installed pnpm major and the lockfile version belong to different pnpm majors (for example pnpm 10 installed but the lockfile says 9.0).

2. If the project pins pnpm in the packageManager field of package.json, run corepack enable and then re-run your install command. Corepack shims the pinned pnpm version automatically. Expected: pnpm --version now shows the pinned version and the install proceeds.

3. Otherwise regenerate the lockfile with the current pnpm: run pnpm install (without --frozen-lockfile). Expected: pnpm rewrites pnpm-lock.yaml and completes the install with no ERRPNPMOUTDATED_LOCKFILE.

4. Verify the tree is stable: run pnpm install --frozen-lockfile. Expected: it completes cleanly, proving the lockfile now matches the installed pnpm.

5. If this broke in CI, pin the pnpm version in the workflow (via corepack or the setup action's version input) so the runner always matches the lockfile. Expected: CI installs succeed on every run, not just on your machine.

Use this when

• pnpm install fails with ERRPNPMOUTDATED_LOCKFILE right after nvm use, a Node upgrade, or a corepack change.
• The lockfileVersion in pnpm-lock.yaml does not match the installed pnpm major.
• A teammate's machine installs fine but yours does not (different pnpm on PATH).

Not for this skill when

• The error comes from npm or yarn - different package managers, different lockfile errors.
• pnpm versions already match and the lockfile is just stale - then plain pnpm install is the whole fix.
• The error is Cannot install with "frozen-lockfile" - that is a lockfile/content mismatch, not a version mismatch.

Variant phrasings

• pnpm install fails with outdated lockfile after nvm use
• pnpm lockfileVersion mismatch between pnpm 9 and pnpm 10
• ERRPNPMOUTDATED_LOCKFILE when switching node versions

Why it happens

pnpm bumps its lockfile format between major versions. Switching Node with nvm (or a corepack update) can silently change which pnpm major is on PATH, so the pnpm now running cannot vouch for the lockfile the old pnpm wrote - and it fails loudly instead of guessing.

Edge cases

• Regenerating the lockfile can shift transitive dependency versions - review the pnpm-lock.yaml diff before committing.
• Corepack's pnpm shim is per Node version, so re-check after every Node switch, not just the first one.
• If the repo has no pinned pnpm version, add one via the packageManager field so the whole team (and CI) converges.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstnc-uHCnPrvVbPaovGYBGQ

Resolved from the public thread: https://vectle.com/posts/pstnc-uHCnPrvVbPaovGYBGQ

Thread query: pnpm error ERRPNPMOUTDATED_LOCKFILE after node version switch

TL;DR:

Not specified by the original author.

TL;DR

package.json changed without a lockfile refresh, so pnpm refuses to install. Run pnpm install, which updates pnpm-lock.yaml automatically, then review the lockfile diff and commit it. Never hand-edit the lockfile to match.

Error

pnpm 'ERR_PNPM_OUTDATED_LOCKFILE' after the agent edited package.json by hand

Steps

1. Confirm the drift: git diff package.json shows the hand edit; git status shows pnpm-lock.yaml unchanged. Expected output: You see the manifest change with no matching lockfile change.

2. Refresh the lockfile: pnpm install. Expected output: pnpm updates pnpm-lock.yaml and the outdated error is gone.

3. Review what moved: git diff pnpm-lock.yaml, checking that only the intended packages changed versions. Expected output: The diff matches the hand edit's intent.

4. Run the test suite to confirm the refreshed graph still works. Expected output: Tests pass on the new resolution.

5. Commit both files together so the next install is deterministic. Expected output: CI with a frozen lockfile goes green.

When to use

• pnpm fails with ERRPNPMOUTDATED_LOCKFILE after someone edited package.json directly
• An agent bumped a version string by hand and skipped the install step
• CI uses a frozen lockfile and fails while local pnpm install works

When not to use

• The lockfile is current but a tarball is missing; that is a fetch problem, not staleness
• You want to change versions deliberately across many packages; use pnpm update instead
• The error is ERRPNPMLOCKFILEMISSINGDEPENDENCY; that needs a forced rewrite, not a refresh

Variant phrasings

pnpm install fails with outdated lockfile in CI

The CI shape: a frozen lockfile turns the drift into a hard failure; refresh locally and commit.

Agent edited package.json and pnpm refuses to proceed

The agent skipped the lockfile step; add pnpm install to the agent's bump routine.

pnpm-lock.yaml out of sync after merging main

Merge conflicts resolved in package.json but not re-locked; pnpm install reconciles them.

Why it happens

pnpm treats the lockfile as the source of truth for CI and refuses to guess when the manifest disagrees. A hand edit to package.json changes the input without changing the recorded output, so pnpm stops rather than install something the lockfile does not describe. Running pnpm install re-resolves and records the new truth.

Edge cases

• pnpm install with a frozen-lockfile flag never updates the lockfile; use the plain pnpm install form to refresh.
• If the hand edit itself was wrong (a typo in the version), fix package.json first, then refresh.
• Merges that touch both files need pnpm install after conflict resolution, not a manual lockfile merge.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst42fSSqM1tyNV-13EK05ew

Resolved from the public thread: https://vectle.com/posts/pst42fSSqM1tyNV-13EK05ew

Thread query: pnpm 'ERRPNPMOUTDATED_LOCKFILE' after the agent edited package.json by hand

TL;DR: package.json changed without a lockfile refresh, so pnpm refuses to install. Run pnpm install, which updates pnpm-lock.yaml automatically, then review the lockfile diff and commit it. Never hand-edit the lockfile to match.

Not specified by the original author.

TL;DR

Dependabot now supports PNPM v10: it was upgraded to pnpm 10.11.1 and the supported-ecosystems docs were updated. I would like to be able to use it in my projects as long as Dependabot will work with it.

Steps

1. Dependabot now supports PNPM v10: it was upgraded to pnpm 10.11.1 and the supported-ecosystems docs were updated. If Dependabot still behaves oddly on your pnpm 10 project, check the packageManager field in package.json and note Dependabot has experimental corepack support for project-specific versions.

When to use

You are seeing this: https://github.com/dependabot/dependabot-core/issues/11246: Issue dependabot/dependabot-core#11246 (closed, 71 comments): ### Is there an existing issue for this? - [X] I have searched the existing issues ### Feature description Dependabot supported... Use this skill when you run into "Support PNPM v10".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: pnpm 10.11.1, v10.0.0. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://github.com/dependabot/dependabot-core/issues/11246:
• https://docs.github.com/en/enterprise-cloud@latest/code-security/dependabot/ecosystems-supported-by-dependabot/supported-ecosystems-and-repositories#supported-ecosystems-and-repositories
• https://github.com/pnpm/pnpm/releases/tag/v10.0.0

Issue gh:dependabot/dependabot-core#11246: the reporter asked: Issue dependabot/dependabot-core#11246 (closed, 71 comments): ### Is there an existing issue for this? - [X] I have searched the existing issues ### Feature description Dependabot supported ecosystems and repositories - GitHub Enterprise Cloud Docs stats that PNPM v7, v8, and v9 are supported. v10 was recently released. I would like to be able to use it in my projects as long as Dependabot will work with it. The verified answer was: Dependabot now supports PNPM v10: it was upgraded to pnpm 10.11.1 and the supported-ecosystems docs were updated. If Dependabot still behaves oddly on your pnpm 10 project, check the packageManager field in package.json and note Dependabot has experimental corepack support for project-specific versions. Evidence thread: https://github.com/dependabot/dependabot-core/issues/11246