Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

10.7.1

Which area(s) of pnpm are affected? (leave empty if unsure)

Lockfile

Link to the code that reproduces this issue or a replay of the bug

https://github.com/azu/pnpm--frozen-lockfile-bug

Reproduction steps

pnpm install --frozen-lockfile does not throw an error when the lockfile is out of sync with pnpm-workspace.yaml's catalog.

Reproduce Repository

• https://github.com/azu/pnpm--frozen-lockfile-bug

This repository's lockfile and catalog reference the package version as follows:

• lodash@4.0.0 in the pnpm-workspace.yaml(catalog)
• lodash@4.17.21 in the lockfile

pnpm-workspace.yaml

• refer lodash@4.0.0 in the workspace file

catalog:
  lodash: 4.0.0

pnpm-lock.yaml

• refer lodash@4.17.21 in the lockfile

lockfileVersion: '9.0'

settings:
  autoInstallPeers: true
  excludeLinksFromLockfile: false

catalogs:
  default:
    lodash:
      specifier: 4.17.21
      version: 4.17.21

importers:

  .:
    dependencies:
      lodash:
        specifier: 'catalog:'
        version: 4.17.21

packages:

  lodash@4.17.21:
    resolution: {integrity: sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==}

snapshots:

  lodash@4.17.21: {}

Reproduce Steps

1. Run pnpm install --frozen-lockfile in the workspace root directory

git clone https://github.com/azu/pnpm--frozen-lockfile-bug
cd pnpm--frozen-lockfile-bug
pnpm install --frozen-lockfile

Describe the Bug

I expect that running pnpm install --frozen-lockfile will throw an error when the lockfile is out of sync with the pnpm-workspace.yaml's catalog.
However, the command does not throw an error in pnpm@10.7.1.

Actual Behavior

The pnpm install --frozen-lockfile does not throw an error.
But, the command pnpm install updates the lockfile to match the pnpm-workspace.yaml.

pnpm install
git diff
diff --git i/pnpm-lock.yaml w/pnpm-lock.yaml
index 41fa5a5..7d83bb3 100644
--- i/pnpm-lock.yaml
+++ w/pnpm-lock.yaml
@@ -7,8 +7,8 @@ settings:
 catalogs:
   default:
     lodash:
-      specifier: 4.17.21
-      version: 4.17.21
+      specifier: 4.0.0
+      version: 4.0.0

 importers:

@@ -16,13 +16,13 @@ importers:
     dependencies:
       lodash:
         specifier: 'catalog:'
-        version: 4.17.21
+        version: 4.0.0

 packages:

-  lodash@4.17.21:
-    resolution: {integrity: sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==}
+  lodash@4.0.0:
+    resolution: {integrity: sha512-bWpSlBobTcHYK9eUzcBYHhSBGzvSzEsxocnW5+v7p6wCRlY1icneTe2ACam3mGdAu82+RLL32cmyl7TRlJHqZw==}

 snapshots:

-  lodash@4.17.21: {}
+  lodash@4.0.0: {}

Expected Behavior

The pnpm install --frozen-lockfile should throw an error indicating that the lockfile is out of sync with the pnpm-workspace.yaml.

Which Node.js version are you using?

v22.13.1

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

No.

Context

I met this issue when dependabot created a PR to update the lockfile and the catalog was not updated. (This looks like a bug in dependabot. dependabot/dependabot-core#11953)

I expected that running pnpm install --frozen-lockfile would throw an error, but it did not.
This behavior is unexpected and could lead to confusion when working with pnpm catalogs.

Related Issue

Following issue is similar to this one, but I met this issue on pnpm catalogs.

• Changes when running pnpm install not reflected when running pnpm install --frozen-lockfile #5794