/errors/bun/lockfile-had-changes-but-lockfile-is-frozen
bun install: error: lockfile had changes, but lockfile is frozen
verified onenvironmentlocal · windows 10.0.26200 arm64 · GNU bash 5.3.15 (Git Bash)updated
- tool
- Bun
- exit code
- 1
- versions
- Bun 1.2+ (bun.lock), Bun 1.0 – 1.1 (bun.lockb)
- os
- any
error: lockfile had changes, but lockfile is frozen means bun install --frozen-lockfile computed a dependency tree that differs from bun.lock, so it refused to update the lockfile. This is what CI should do when package.json changed but the lockfile was not regenerated. Run bun install on your machine and commit the updated bun.lock together with package.json.
Reproduce it
cat > package.json <<'EOF'
{ "name": "app", "dependencies": { "is-number": "7.0.0" } }
EOF
npx --yes bun@1 install > /dev/null 2>&1
# add a dependency without updating bun.lock
cat > package.json <<'EOF'
{ "name": "app", "dependencies": { "is-number": "7.0.0", "is-odd": "3.0.1" } }
EOF
npx --yes bun@1 install --frozen-lockfile 2>&1 | grep -E "^(error|note):"
exit "${PIPESTATUS[0]}"Output · exit 1
error: lockfile had changes, but lockfile is frozen note: try re-running without --frozen-lockfile and commit the updated lockfile
Fix
bun install # updates bun.lock
git add package.json bun.lock
git commit -m "Update dependencies"Then keep --frozen-lockfile in CI: it guarantees the build uses exactly the committed versions.
Lockfile formats
| Bun version | Lockfile | Notes |
|---|---|---|
| 1.2 and later | bun.lock | Text (JSONC), reviewable in diffs; the default |
| 1.0 – 1.1 | bun.lockb | Binary; bun install --save-text-lockfile converts it to bun.lock |
Sources
Related pages
errors · pnpmERR_PNPM_NO_LOCKFILE Cannot install with "frozen-lockfile" because pnpm-lock.yaml is absentpnpm install fails with ERR_PNPM_NO_LOCKFILE in CI because frozen-lockfile is on and pnpm-lock.yaml is not committed. Commit the lockfile from a local install.flags · yarnyarn install --frozen-lockfile (Yarn 1) and --immutable (Yarn 2+)yarn install --frozen-lockfile fails instead of updating yarn.lock when it is out of date; Yarn 2+ uses --immutable. Real errors and the lockfile fix.compare · npmnpm ci vs npm install: differences and when to use eachnpm ci installs exactly what package-lock.json says, deletes node_modules first and never edits the lockfile; npm install resolves ranges and may update it.