ERR_PNPM_OUTDATED_LOCKFILE Cannot install with "frozen-lockfile" because pnpm-lock.yaml is not up to date

ERR_PNPM_OUTDATED_LOCKFILE Cannot install with "frozen-lockfile" because pnpm-lock.yaml is not up to date with <ROOT>/package.json means the dependencies in package.json no longer match the ones recorded in pnpm-lock.yaml, and pnpm runs with --frozen-lockfile, which CI enables by default. pnpm refuses to update the lockfile there. Run pnpm install on your machine and commit the regenerated pnpm-lock.yaml.

Reproduce it

cat > package.json <<'EOF'
{ "name": "app", "version": "1.0.0", "dependencies": { "is-number": "7.0.0" } }
EOF
npx --yes pnpm@9 install > /dev/null 2>&1
# add a dependency without re-running pnpm install
cat > package.json <<'EOF'
{ "name": "app", "version": "1.0.0", "dependencies": { "is-number": "7.0.0", "is-odd": "3.0.1" } }
EOF
npx --yes pnpm@9 install --frozen-lockfile

 ERR_PNPM_OUTDATED_LOCKFILE  Cannot install with "frozen-lockfile" because pnpm-lock.yaml is not up to date with <ROOT>\package.json

Note that in CI environments this setting is true by default. If you still need to run install in such cases, use "pnpm install --no-frozen-lockfile"

    Failure reason:
    specifiers in the lockfile ({"is-number":"7.0.0"}) don't match specs in package.json ({"is-number":"7.0.0","is-odd":"3.0.1"})

The Failure reason line names what differs: here the specifiers in the lockfile lack is-odd. <ROOT> stands for the workspace root (pnpm prints a backslash before package.json on Windows).

Fix

pnpm install
git add package.json pnpm-lock.yaml
git commit -m "Update lockfile"

Then CI passes again with frozen-lockfile on:

cat > package.json <<'EOF'
{ "name": "app", "version": "1.0.0", "dependencies": { "is-number": "7.0.0", "is-odd": "3.0.1" } }
EOF
npx --yes pnpm@9 install > /dev/null 2>&1
npx --yes pnpm@9 install --frozen-lockfile > /dev/null 2>&1
echo "frozen install exit=$?"

frozen install exit=0

Other reasons the check fails

The message is the same when pnpm settings that are stored in the lockfile change, for example overrides or patchedDependencies in package.json or pnpm-workspace.yaml. The failure reason then mentions the setting; the fix is the same: run pnpm install and commit.