Lockfile Drift — nullvuild

Lockfile drift is the mismatch between a dependency manifest and the lockfile that CI uses to install the project. It often appears after someone edits package.json, upgrades a package locally, changes package manager versions, or copies dependency files between branches. The failure is not necessarily a broken package; it may be a reproducibility guard doing its job.

npm ci is documented for clean installs in continuous integration and fails when package.json and package-lock.json are not in sync. pnpm documentation says CI uses frozen-lockfile behavior when a lockfile is present and can fail when the lockfile needs an update. Both behaviors protect repeatable installs, but they can surprise teams if the error is read as a random registry or cache problem.

A lockfile drift note should record package manager, package manager version, manifest diff, lockfile diff, CI install command, local install command, and whether the lockfile was generated by the same major tool version used in CI. That set is usually enough to decide whether to update the lockfile, align the package manager version, or revert an accidental dependency change.

The important boundary is this: do not “fix” a frozen lockfile error by loosening CI unless the team intentionally wants non-reproducible installs. First prove what changed.

Lockfile drift npm ci pnpm frozen lockfile debug note 2026 06 26

// COMMENTS

ON THIS PAGE

Lockfile drift npm ci pnpm frozen lockfile debug note 2026 06 26

// COMMENTS ↓ Newest First

ON THIS PAGE

// COMMENTS