Skip to content

"Ignoring broken lockfile at ... pnpm-lock.yaml not compatible with current pnpm" warning should be an error when run in CI #10908

@DetachHead

Description

@DetachHead

Verify latest release

  • I verified that the issue exists in the latest pnpm release

pnpm version

10.31

Which area(s) of pnpm are affected? (leave empty if unsure)

Lockfile

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

  1. manually change lockfileVersion in pnpm-lock.yaml to an older version eg. lockfileVersion: 1.0
  2. run CI=1 pnpm ci

Describe the Bug

when the lockfile is not compatible with the current version of pnpm, it should definitely be an error instead of a warning when run in CI:

$ CI=1 pnpm i
 WARN  Ignoring not compatible lockfile at /project/pnpm-lock.yaml
Progress: resolved 1, reused 0, downloaded 0, added 0
 WARN  deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
Progress: resolved 45, reused 45, downloaded 0, added 0

otherwise the warning will never be noticed by anyone which is a security issue because unverified versions of dependencies will be installed without the user's knowledge. this completely defeats the point of having a lockfile

Expected Behavior

an error is reported and the command exits with a non-zero exit code before installing anything

Which Node.js version are you using?

24.14.0

Which operating systems have you used?

  • macOS
  • Windows
  • Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

ubuntu

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions